rclone v1.75.0 released
By SecBurg
rclone is a command-line program to sync files and directories to and from a huge range of cloud storage providers, often described as “rsync for cloud storage”.
The new v1.75.0 release is a big one on the security side: it fixes an FTP command injection, an SFTP command injection via crafted filenames, several credential-leaking redirect issues in S3 and WebDAV, a path traversal bug in serve restic, and an unauthenticated pprof exposure in the remote control API, among others.
Beyond the security fixes, this release also brings:
Two new S3 providers: Scality (RING / ARTESCA) and Zero Services (ZERO-Z3)
A new config unset command to remove options from a remote
Support for nested {} alternates in glob filters, plus --files-from0 for NUL-delimited input
serve s3 now streams multipart uploads to the backend instead of buffering them in memory
A new --sftp-pin-host-key flag for Trust On First Use host key pinning
Lots of modtime and hash correctness fixes across backends like Dropbox, Onedrive, SMB, Yandex, and more
Full changelog with all details is available on the rclone changelog page, release notes and downloads on the GitHub release page.
Happy cloning! :-)