CLSA-2026-1782739272
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1782739272.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1782739272
- Upstream
CVE (2)
- Published
- 2026-06-29T13:21:30Z
- Modified
- 2026-10-26T09:32:05Z
- Summary
- Fix CVE(s): CVE-2026-29518, CVE-2026-41035
- Details
-
- PACKAGING FIX: rsync daemon default group on stock Ubuntu/Debian (ELSR-8050)
- the daemon's compile-time NOBODY_GROUP was resolved to "nobody" by the focal build chroot's /etc/group, but stock Ubuntu/Debian have only "nogroup", so daemon modules with no explicit gid were rejected with "@ERROR: invalid gid nobody" (test_daemon / ELSR-8050)
- debian/rules: build with rsync's own --with-nobody-group=nogroup configure option so the compile-time NOBODY_GROUP default is baked as "nogroup" regardless of the build chroot, matching the stock Ubuntu/Debian rsync build (fixes modules with no explicit gid)
- debian/patches/rsync-daemon-nobody-group-fallback.patch: in the daemon's add_a_group() resolve a "nobody" group to "nogroup" at runtime when the host has no "nobody" group, so a module that explicitly sets "gid = nobody" is also honoured on stock Ubuntu/Debian instead of being rejected with "@ERROR: invalid gid nobody"; any other unresolvable group is still rejected
- upstream: configure.ac AC_ARG_WITH(nobody-group) https://github.com/RsyncProject/rsync/blob/v3.1.3/configure.ac#L142-L157 Debian bugs #144570 (https://bugs.debian.org/144570) and #25299
- ELSR-8050
- PACKAGING FIX: rsync daemon default group on stock Ubuntu/Debian (ELSR-8050)
- References