Assigning to Stig who looks after this package.

Assignee: bugsquad => smelror

openSUSE has issued an advisory on January 14:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/MCLAZVPDAT5UFMI67YRTRQBKGNJYHBIS/

Summary: rclone new security issue CVE-2024-52522 => rclone new security issues CVE-2024-52522 and CVE-2024-4533[78]
Status comment: Fixed upstream in 1.68.2 and patch available from upstream => Fixed upstream in 1.69
CVE: CVE-2024-52522 => CVE-2024-52522, CVE-2024-45337, CVE-2024-45338

(In reply to Lewis Smith from comment #1)
> Assigning to Stig who looks after this package.
Or did...
Which is why this bug has hung around nearly 18m.
Re-assigning it to Bruno, who looks to have taken over managing rclone - and recently.
Stig had in fact update Cauldron to version 1.69.2 nearly a year ago. Since then, we have 1.72.x.
So Mageia 9 needs updating.

Assignee: smelror => bruno

Trying to update to the 1.73.4 version leads to an issue reported upstream: https://github.com/rclone/rclone/issues/9351

CC: (none) => bruno
Status: NEW => ASSIGNED

caldron updated to 1.73.5

Same version submitted to mga9.

Assignee: bruno => qa-bugs

Can please explain the inclusion of CVE-2024-4533[78]? they look as go issues.
Thank you

Keywords: (none) => feedback

(In reply to Bruno Cornec from comment #6)
> Same version submitted to mga9.

I'm not seeing an rclone update in the updates_testing repository.
Is the update package not yet available or am I locking in the wrong repo?

$ urpmf -fm --name rclone
Core Release:rclone-1.62.1-1.mga9.x86_64
Core Updates Testing:rclone-1.62.1-1.mga9.x86_64
Core 32bit Release:rclone-1.62.1-1.mga9.i586

That's odd as the build page tells it was uploaded:
https://pkgsubmit.mageia.org/
https://pkgsubmit.mageia.org/uploads/done/cauldron/core/release/20260501141812.bcornec.duvel.4012488/status.log

I'll remove 1.62.1 already in release and build again 1.73.5

Hummm, my fault (as usual). svn ci wasn't done.

Build in progress.

Installed and tested without issues.

Tested:
- backups upload to backblaze;
- encrypted remotes;
- list, upload, download, remove, sync;
- remotes: backblaze, google drive.
All that was tested worked without issues.
rclone supports lost of other remotes but backblaze and google drive.



System: Mageia 9, x86_64, Plasma DE, AMD Ryzen 5 5600G with Radeon Graphics using the amdgpu driver.



$ uname -a
Linux jupiter 6.6.137-desktop-1.mga9 #1 SMP PREEMPT_DYNAMIC Thu Apr 30 22:24:10 UTC 2026 x86_64 GNU/Linux
$ rpm -q rclone
rclone-1.73.5-1.mga9

I was waiting for some more test but this is a security issue and needs to be pushed forward, so I'm giving it the OK for x86_64.

Flags: (none) => test_passed_mga9_64+
Whiteboard: (none) => MGA9-64-OK

Validating.

Katnatek still needs an answer to his question in comment 7 so he can write the advisory.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

(In reply to katnatek from comment #7)
> Can please explain the inclusion of CVE-2024-4533[78]? they look as go
> issues.
> Thank you

I'm not a go dev, but I guess that routing people to read the CVE descriptions at https://nvd.nist.gov/vuln/detail/CVE-2024-45337 and https://nvd.nist.gov/vuln/detail/CVE-2024-45338 is the right thing to do.

(In reply to Bruno Cornec from comment #15)
> (In reply to katnatek from comment #7)
> > Can please explain the inclusion of CVE-2024-4533[78]? they look as go
> > issues.
> > Thank you
> 
> I'm not a go dev, but I guess that routing people to read the CVE
> descriptions at https://nvd.nist.gov/vuln/detail/CVE-2024-45337 and
> https://nvd.nist.gov/vuln/detail/CVE-2024-45338 is the right thing to do.

That is the information that I find, and still not clear to me how this affect to rclone, rclone is written in go and/or make use of the affected go features?

I should not have to dig in source code or spec to write advisory.

opensuse reference just list CVE-2024-52522

And upstream advisory not list cve's ids

https://github.com/rclone/rclone/security/advisories/GHSA-hrxh-9w67-g4cv

(In reply to katnatek from comment #16)
> I should not have to dig in source code or spec to write advisory.
> 
> opensuse reference just list CVE-2024-52522
> 
> And upstream advisory not list cve's ids
> 
My bad list only CVE-2024-52522, un right part of the page

https://rclone.org/changelog/#v1-73-5-2026-04-19

List CVE-2026-41179,CVE-2026-41176

https://rclone.org/changelog/#v1-73-4-2026-04-08

CVE-2026-32282, CVE-2026-32289, CVE-2026-33810, CVE-2026-27144,
CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, CVE-2026-27140, 
CVE-2026-32280, CVE-2026-32281

https://rclone.org/changelog/#v1-73-3-2026-03-23

CVE-2026-33186

https://rclone.org/changelog/#v1-73-2-2026-03-06

CVE-2026-27137, CVE-2026-27138, CVE-2026-25679, CVE-2026-27142,
CVE-2026-1229, CVE-2026-27141

https://rclone.org/changelog/#v1-73-1-2026-02-17

CVE-2025-68121 (for this golang should be updated in mageia 9 to >=1.25.7 if I understand well)

https://rclone.org/changelog/#v1-73-0-2026-01-30

https://rclone.org/changelog/#v1-72-1-2025-12-10
CVE-2025-61729 (need new golang)

https://rclone.org/changelog/#v1-72-0-2025-11-21

CVE-2025-58181 

I'll continue latter but look for me that validation should be removed and 
we most update golang in mageia 9

https://rclone.org/changelog/#v1-71-2-2025-10-20

https://rclone.org/changelog/#v1-71-1-2025-09-24

https://rclone.org/changelog/#v1-71-0-2025-08-22

https://rclone.org/changelog/#v1-70-3-2025-07-09

https://rclone.org/changelog/#v1-70-2-2025-06-27

https://rclone.org/changelog/#v1-70-1-2025-06-19

https://rclone.org/changelog/#v1-70-0-2025-06-17

https://rclone.org/changelog/#v1-69-3-2025-05-21

https://rclone.org/changelog/#v1-69-2-2025-05-01

CVE-2025-30204, CVE-2025-30204, CVE-2025-22869, CVE-2025-22870,
CVE-2025-22869, 

https://rclone.org/changelog/#v1-69-1-2025-02-14

https://rclone.org/changelog/#v1-69-0-2025-01-12

CVE-2024-45337 & CVE-2024-45338 (at last)

https://rclone.org/changelog/#v1-68-2-2024-11-15

CVE-2024-52522

https://rclone.org/changelog/#v1-68-1-2024-09-24

https://rclone.org/changelog/#v1-68-0-2024-09-08

https://rclone.org/changelog/#v1-67-0-2024-06-14

CVE-2023-45288, CVE-2024-35255, 

https://rclone.org/changelog/#v1-66-0-2024-03-10

https://rclone.org/changelog/#v1-65-2-2024-01-24

https://rclone.org/changelog/#v1-65-1-2024-01-08

CVE-2023-48795

https://rclone.org/changelog/#v1-65-0-2023-11-26

https://rclone.org/changelog/#v1-64-2-2023-10-19

https://rclone.org/changelog/#v1-64-1-2023-10-17

https://rclone.org/changelog/#v1-64-0-2023-09-11

https://rclone.org/changelog/#v1-63-1-2023-07-17

https://rclone.org/changelog/#v1-63-0-2023-06-30

https://rclone.org/changelog/#v1-62-2-2023-03-16

So the list of cve was uncomplete due the version selected to fix the listed vulnerabilities, and some vulnerabilities require update golang first.

I'll work on that, and then rebuild rclone

Keywords: feedback, validated_update => (none)
Depends on: (none) => 35181
Whiteboard: MGA9-64-OK => (none)

[S]RPM: rclone-1.73.5-1.1.mga9

PC LX Please test this package.

Flags: test_passed_mga9_64+ => (none)
Status comment: Fixed upstream in 1.69 => Package to test in comment 20

Tried rclone config to get a remote on Google Drive, but got lost on all options of which at least half I do not understand.
But at least no crashes or obviously nonsense behavior.

CC: (none) => herman.viaene

The second update has been in use for about two days without issues.
I also repeated the tests (see comment 12), and it is working OK.
It get an OK from me for x86_64.

$ rpm -q rclone
rclone-1.73.5-1.1.mga9

(In reply to PC LX from comment #22)
> The second update has been in use for about two days without issues.
> I also repeated the tests (see comment 12), and it is working OK.
> It get an OK from me for x86_64.

Thanks, @Thomas, please set validation again

Whiteboard: (none) => MGA9-64-OK
Flags: (none) => test_passed_mga9_64+

Validating.

Keywords: (none) => validated_update

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2026-0147.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED