CLSA-2026-1788799362
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1788799362.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1788799362
- Upstream
- Published
- 2026-09-07T16:42:56Z
- Modified
- 2026-10-26T09:43:25Z
- Summary
- Fix of 7 CVEs
- Details
-
- SECURITY UPDATE: symlink attacks on daemon operator-supplied paths
- debian/patches/CVE-2026-53784.patch: add safe_open_no_attacker_symlinks() in util.c and confine the daemon module-root chdir under use-chroot=no
- CVE-2026-53784
- SECURITY UPDATE: information disclosure via planted symlinks
- debian/patches/CVE-2026-53802-CVE-2026-53803.patch: open the secrets file, --password-file, batch, log, config and exclude/include files through safe_open_no_attacker_symlinks()
- CVE-2026-53802
- CVE-2026-53803
- SECURITY UPDATE: information disclosure via symlinked filter/merge files
- debian/patches/CVE-2026-53786.patch: open filter and per-directory merge files through safe_open_no_attacker_symlinks() and treat a merge file hidden by the daemon filter as absent
- CVE-2026-53786
- SECURITY UPDATE: arbitrary file write via absolute --temp-dir/--link-dest
- debian/patches/CVE-2026-53795.patch: confine do_rename() and do_link() in syscall.c through an ownership walk on the pinned parent directory fd
- CVE-2026-53795
- SECURITY UPDATE: daemon crash via a malformed file list entry
- debian/patches/CVE-2026-70459.patch: reject a non-directory transfer-root entry and bound parent_ndx in flist.c, generator.c and receiver.c
- CVE-2026-70459
- SECURITY UPDATE: "auth users" entries parsed on whitespace
- debian/patches/CVE-2026-70463.patch: parse the daemon's "auth users" list with conf_strtok() in authenticate.c so it splits on commas alone
- CVE-2026-70463
- The non-directory transfer-root guard shipped in +tuxcare.els5 under debian/patches/CVE-2026-53789.patch now lives in debian/patches/CVE-2026-70459.patch, no functional change
- The upstream regression tests named in the patch headers are not carried: upstream ships them only as pytest testsuite/*_test.py files and 3.1.3 has no pytest harness
- SECURITY UPDATE: symlink attacks on daemon operator-supplied paths
- References
-
- https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1788799362.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-53784
- https://nvd.nist.gov/vuln/detail/CVE-2026-53786
- https://nvd.nist.gov/vuln/detail/CVE-2026-53795
- https://nvd.nist.gov/vuln/detail/CVE-2026-53802
- https://nvd.nist.gov/vuln/detail/CVE-2026-53803
- https://nvd.nist.gov/vuln/detail/CVE-2026-70459
- https://nvd.nist.gov/vuln/detail/CVE-2026-70463