Nick Craig-Wood 672bbf75ec selfupdate: fix hash check trusting unsigned data in the signed SHA256SUMS GHSA-w33h-3qgq-8mv8 CVE-PENDING ...

rclone selfupdate checked the PGP signature on the clearsigned block
of SHA256SUMS but then looked up the archive hash in the whole
downloaded file. Unsigned data can appear in that file without
invalidating the signature. A hash line placed before or after the
signed text was accepted, allowing whoever controlled the download to
install an arbitrary unsigned archive.

The hash is now only looked up in the signed text.

Affects stable (non --beta) selfupdate since v1.55.0. --beta updates
are not signature checked.

2026-10-08 22:49:33 +01:00

..

about

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

all

index: add a command to write static directory listings into a remote

2026-09-29 18:21:23 +01:00

archive

archive: fix crash when creating archive to stdout - fixes #9910

2026-09-14 10:34:33 +02:00

authorize

docs: add link from authorize command docs to remote setup docs

2025-10-02 18:46:16 +02:00

backend

docs: fix markdownlint issues in backend command generated output

2025-11-04 23:00:46 +01:00

bisync

bisync: make --max-delete aware of --track-renames

2026-09-30 17:53:20 +01:00

cachestats

docs: consistent newline of first line in command output

2024-08-15 18:26:34 +02:00

cat

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

check

operations: share the report file opening between check and sync

2026-09-08 10:34:07 +01:00

checksum

docs: consistent newline of first line in command output

2024-08-15 18:26:34 +02:00

cleanup

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

cmount

cmount: ignore com.apple.* xattrs on the macOS FSKit backend

2026-09-15 12:10:22 +01:00

config

config: add config unset command to remove options from a remote - fixes #9541

2026-07-10 18:45:41 +01:00

convmv

build: use "for i := range n", added in go1.22

2025-09-15 12:45:57 +01:00

copy

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

copyto

docs: clarify copyto command description - Fixes #9527

2026-06-29 18:19:49 +01:00

copyurl

build: modernize with "go fix -atomictypes": use sync/atomic types

2026-08-21 12:23:31 +01:00

cryptcheck

fix: comment typos

2025-11-13 13:47:40 +00:00

cryptdecode

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

dedupe

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

delete

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

deletefile

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

genautocomplete

cmd: complete enum flag values from their choices - fixes #5847

2026-10-08 15:07:41 +01:00

gendocs

gendocs: refactor and add logging of skipped command docs

2025-09-02 14:06:31 +02:00

gitannex

gitannex: reduce subprocess launches in end to end test setup

2026-08-02 18:25:09 +01:00

gui

gui: update embedded release to 1.1.13

2026-10-08 16:51:58 +01:00

hashsum

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

index

index: add partial runs which only re-index changed directories

2026-09-29 18:21:23 +01:00

link

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

listremotes

listremotes: add --exact flag for filtering - fixes #9076

2026-04-24 16:23:12 +01:00

ls

docs: lshelp: explain that a directory on a bucket-based remote is a key prefix

2026-09-10 15:46:08 +01:00

lsd

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

lsf

lsf: document Google Drive shortcut IDs - fixes #7863

2026-07-24 15:00:09 +01:00

lsjson

docs: fix typos in comments and messages

2026-01-18 20:48:33 +01:00

lsl

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

md5sum

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

mkdir

docs: group the global flags and make them appear on command and flags pages

2023-08-02 12:53:09 +01:00

mount

mountlib: fix VFS instance leaks on mount failures and unmounts

2026-08-18 09:03:12 +01:00

mount2

mountlib: fix VFS instance leaks on mount failures and unmounts

2026-08-18 09:03:12 +01:00

mountlib

mount: fix --daemon failing when --rc is enabled - fixes #9196

2026-10-08 14:19:18 +01:00

move

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

moveto

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

ncdu

ncdu: show progress and the item count when deleting a selection

2026-09-30 17:57:47 +01:00

nfsmount

mountlib: fix VFS instance leaks on mount failures and unmounts

2026-08-18 09:03:12 +01:00

obscure

docs: fix echo command syntax for password input

2026-01-18 20:56:26 +01:00

purge

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

rc

rc: flip auth default so all endpoints require auth unless opted out

2026-04-19 13:31:27 +01:00

rcat

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

rcd

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

reveal

docs: add minimum versions to the command pages

2022-12-03 18:58:55 +01:00

rmdir

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

rmdirs

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

selfupdate

selfupdate: fix hash check trusting unsigned data in the signed SHA256SUMS GHSA-w33h-3qgq-8mv8 CVE-PENDING

2026-10-08 22:49:33 +01:00

serve

vfs: fix serve nfs path traversal by refusing unsafe file names GHSA-44pm-2q5p-fm63 CVE-PENDING

2026-10-08 22:49:33 +01:00

settier

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

sha1sum

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

size

size: include source in JSON output - fixes #5429

2026-08-13 19:37:59 +02:00

sync

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

test

docs: fix typo in speed test help text

2026-10-04 09:14:02 +02:00

touch

touch: parse documented timestamp formats

2026-09-09 10:24:48 +01:00

tree

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

version

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

cmd_test.go

mount: fix --daemon failing when --rc is enabled - fixes #9196

2026-10-08 14:19:18 +01:00

cmd.go

cmd: complete enum flag values from their choices - fixes #5847

2026-10-08 15:07:41 +01:00

completion_test.go

cmd: complete enum flag values from their choices - fixes #5847

2026-10-08 15:07:41 +01:00

completion.go

cmd: complete enum flag values from their choices - fixes #5847

2026-10-08 15:07:41 +01:00

help.go

docs: don't show fully hidden backend options in the backend docs

2026-07-29 20:16:22 +01:00

progress.go

build: modernize Go code with go fix for go1.25

2026-02-18 12:11:52 +00:00

selfupdate_disabled.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00

selfupdate_enabled.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00

siginfo_bsd.go

build: update logging statements to make json log work - fixes #6038

2024-09-06 17:04:18 +01:00

siginfo_others.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00