7 matches found
CVE-2026-116189
rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious...
EUVD-2026-109447
rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious...
CVE-2026-116189 rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS
rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious...
CVE-2026-116189
The rclone utility (versions 1.55.0 before 1.75.2 ) is vulnerable to a signature verification bypass within its stable selfupdate functionality. The root cause is that the software trusts checksums from unsigned bytes that precede the PGP-clearsigned SHA256SUMS block. An attacker who controls the...
PT-2026-123030
rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious...
CVE-2024-11681 Remote Code Execution in MacPorts
A malicious or compromised MacPorts mirror can execute arbitrary commands as root on the machine of a client running port selfupdate against the mirror...
CVE-2024-11681: Improper Neutralization of Special Elements used in an OS Command
A malicious or compromised MacPorts mirror can execute arbitrary commands as root on the machine of a client running port selfupdate against the mirror...