CLSA-2026-1788815738
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788815738.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1788815738
- Upstream
- Published
- 2026-09-07T22:37:24Z
- Modified
- 2026-10-26T09:32:04Z
- Summary
- Fix CVE(s): CVE-2026-53786, CVE-2026-53789, CVE-2026-70459, CVE-2026-70463
- Details
-
- SECURITY UPDATE: authorization bypass in "auth users" @Group Name parsing
- debian/patches/CVE-2026-70463.patch: tokenise the "auth users" value with conf_strtok() in authenticate.c, imported into util.c and declared in proto.h, so a leading comma splits on commas alone and an @Group Name entry containing a space is no longer torn in two and its deny rule silently discarded
- CVE-2026-70463
- SECURITY UPDATE: daemon filter-merge bypass of the module filter list
- debian/patches/CVE-2026-53786.patch: strip module_dirlen from an absolute --filter merge path in parse_filter_file() in exclude.c before checking it against daemon_filter_list, so an anchored module-relative daemon rule matches, and treat a merge file hidden by the daemon filter as non-existent instead of a fatal error
- CVE-2026-53786
- SECURITY UPDATE: daemon NULL dereference on a non-directory transfer root
- debian/patches/CVE-2026-70459.patch: reject a "." or "/." transfer-root entry that is not a directory in recv_file_entry() in flist.c, instead of dereferencing it as a directory structure pointer, and require dir_flist to actually hold an entry in recv_file_list() before trusting parent_ndx 0, closing the second route to the same uninitialised dir_flist->files[0]
- CVE-2026-70459
- SECURITY UPDATE: --delete scope widening via implied-parent reclassification
- debian/patches/CVE-2026-53789.patch: add is_implied_parent_dir() to exclude.c and use it in recv_file_entry() in flist.c to force an implied parent directory back to the honest XMIT_TOP_DIR|XMIT_NO_CONTENT_DIR encoding, so it lands in FLAG_IMPLIED_DIR and delete_in_dir() cannot sweep pre-existing siblings; also covers the synthetic transfer-root entry and the legacy protocol < 30 XMIT_TOP_DIR path
- CVE-2026-53789
- SECURITY UPDATE: authorization bypass in "auth users" @Group Name parsing
- References