Nick Craig-Wood 672bbf75ec selfupdate: fix hash check trusting unsigned data in the signed SHA256SUMS GHSA-w33h-3qgq-8mv8 CVE-PENDING ...

rclone selfupdate checked the PGP signature on the clearsigned block
of SHA256SUMS but then looked up the archive hash in the whole
downloaded file. Unsigned data can appear in that file without
invalidating the signature. A hash line placed before or after the
signed text was accepted, allowing whoever controlled the download to
install an arbitrary unsigned archive.

The hash is now only looked up in the signed text.

Affects stable (non --beta) selfupdate since v1.55.0. --beta updates
are not signature checked.

2026-10-08 22:49:33 +01:00

..

testdata/verify

selfupdate: fix "invalid hashsum signature" error

2023-10-18 17:55:19 +01:00

noselfupdate.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00

selfupdate_test.go

selfupdate: fix --version X.Y depending on ./ in the download site links

2026-09-30 12:14:28 +01:00

selfupdate.go

selfupdate: fix --version X.Y depending on ./ in the download site links

2026-09-30 12:14:28 +01:00

selfupdate.md

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

verify_test.go

selfupdate: fix hash check trusting unsigned data in the signed SHA256SUMS GHSA-w33h-3qgq-8mv8 CVE-PENDING

2026-10-08 22:49:33 +01:00

verify.go

selfupdate: fix hash check trusting unsigned data in the signed SHA256SUMS GHSA-w33h-3qgq-8mv8 CVE-PENDING

2026-10-08 22:49:33 +01:00

writable_unix.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00

writable_unsupported.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00

writable_windows.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00