rpm package
opensuse/rclone&distro=openSUSE Leap 16.0
pkg:rpm/opensuse/rclone&distro=openSUSE%20Leap%2016.0
Vulnerabilities (37)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-59733 | Hig | 8.8 | < 1.74.4-bp160.1.1 | 1.74.4-bp160.1.1 | Jul 14, 2026 | Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleane | |
| CVE-2026-59732 | Med | 5.0 | < 1.74.4-bp160.1.1 | 1.74.4-bp160.1.1 | Jul 14, 2026 | Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path co | |
| CVE-2026-54572 | Hig | 7.5 | < 1.74.4-bp160.1.1 | 1.74.4-bp160.1.1 | Jul 14, 2026 | Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing | |
| CVE-2026-49980 | Cri | 9.8 | < 1.74.4-bp160.1.1 | 1.74.4-bp160.1.1 | Jun 24, 2026 | Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from | |
| CVE-2026-42507 | Med | 5.3 | < 1.74.4-bp160.1.1 | 1.74.4-bp160.1.1 | Jun 2, 2026 | When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged. | |
| CVE-2026-42504 | Hig | 7.5 | < 1.74.4-bp160.1.1 | 1.74.4-bp160.1.1 | Jun 2, 2026 | Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. | |
| CVE-2026-27145 | Med | 6.5 | < 1.74.4-bp160.1.1 | 1.74.4-bp160.1.1 | Jun 2, 2026 | (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratic | |
| CVE-2026-44740 | Med | 6.5 | < 1.74.4-bp160.1.1 | 1.74.4-bp160.1.1 | Jun 1, 2026 | Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise | |
| CVE-2026-42500 | Med | 5.3 | < 1.74.4-bp160.1.1 | 1.74.4-bp160.1.1 | May 29, 2026 | Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image. | |
| CVE-2026-39824 | Low | 3.3 | < 1.74.4-bp160.1.1 | 1.74.4-bp160.1.1 | May 22, 2026 | NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error. | |
| CVE-2026-42506 | Med | 6.1 | < 1.74.4-bp160.1.1 | 1.74.4-bp160.1.1 | May 22, 2026 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | |
| CVE-2026-42502 | Med | 6.1 | < 1.74.4-bp160.1.1 | 1.74.4-bp160.1.1 | May 22, 2026 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | |
| CVE-2026-39821 | Cri | 9.6 | < 1.74.4-bp160.1.1 | 1.74.4-bp160.1.1 | May 22, 2026 | The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in program | |
| CVE-2026-27136 | Med | 6.1 | < 1.74.4-bp160.1.1 | 1.74.4-bp160.1.1 | May 22, 2026 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | |
| CVE-2026-25681 | Med | 6.1 | < 1.74.4-bp160.1.1 | 1.74.4-bp160.1.1 | May 22, 2026 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | |
| CVE-2026-25680 | Med | 6.5 | < 1.74.4-bp160.1.1 | 1.74.4-bp160.1.1 | May 22, 2026 | Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. | |
| CVE-2026-46598 | Med | 5.3 | < 1.74.4-bp160.1.1 | 1.74.4-bp160.1.1 | May 22, 2026 | For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used. | |
| CVE-2026-46597 | Hig | 7.5 | < 1.74.4-bp160.1.1 | 1.74.4-bp160.1.1 | May 22, 2026 | An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. | |
| CVE-2026-46595 | Cri | 10.0 | < 1.74.4-bp160.1.1 | 1.74.4-bp160.1.1 | May 22, 2026 | Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped. | |
| CVE-2026-42508 | Cri | 9.1 | < 1.74.4-bp160.1.1 | 1.74.4-bp160.1.1 | May 22, 2026 | Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked. |
- affected < 1.74.4-bp160.1.1fixed 1.74.4-bp160.1.1
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleane
- affected < 1.74.4-bp160.1.1fixed 1.74.4-bp160.1.1
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path co
- affected < 1.74.4-bp160.1.1fixed 1.74.4-bp160.1.1
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing
- affected < 1.74.4-bp160.1.1fixed 1.74.4-bp160.1.1
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from
- affected < 1.74.4-bp160.1.1fixed 1.74.4-bp160.1.1
When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.
- affected < 1.74.4-bp160.1.1fixed 1.74.4-bp160.1.1
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
- affected < 1.74.4-bp160.1.1fixed 1.74.4-bp160.1.1
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratic
- affected < 1.74.4-bp160.1.1fixed 1.74.4-bp160.1.1
Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise
- affected < 1.74.4-bp160.1.1fixed 1.74.4-bp160.1.1
Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image.
- affected < 1.74.4-bp160.1.1fixed 1.74.4-bp160.1.1
NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.
- affected < 1.74.4-bp160.1.1fixed 1.74.4-bp160.1.1
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
- affected < 1.74.4-bp160.1.1fixed 1.74.4-bp160.1.1
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
- affected < 1.74.4-bp160.1.1fixed 1.74.4-bp160.1.1
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in program
- affected < 1.74.4-bp160.1.1fixed 1.74.4-bp160.1.1
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
- affected < 1.74.4-bp160.1.1fixed 1.74.4-bp160.1.1
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
- affected < 1.74.4-bp160.1.1fixed 1.74.4-bp160.1.1
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
- affected < 1.74.4-bp160.1.1fixed 1.74.4-bp160.1.1
For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.
- affected < 1.74.4-bp160.1.1fixed 1.74.4-bp160.1.1
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
- affected < 1.74.4-bp160.1.1fixed 1.74.4-bp160.1.1
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
- affected < 1.74.4-bp160.1.1fixed 1.74.4-bp160.1.1
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
Page 1 of 2