CLSA-2026-1788816257
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1788816257.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1788816257
- Upstream
- Published
- 2026-09-07T21:24:31Z
- Modified
- 2026-10-26T09:43:35Z
- Summary
- Fix CVE(s): CVE-2026-53786, CVE-2026-53789, CVE-2026-70459, CVE-2026-70463
- Details
-
- SECURITY UPDATE: "auth users" authorization bypass on entries containing
a space
- debian/patches/CVE-2026-70463.patch: parse the "auth users" value with conf_strtok() in auth_server(), so the documented leading-comma form splits on commas alone and an "@Group Name:deny" entry is no longer torn in two -- discarding the deny rule and creating an implicit allow rule from its first word; import conf_strtok() into util.c, which this version does not yet carry; document the leading-comma form in rsyncd.conf.yo and in the pre-generated rsyncd.conf.5 (this tree ships no yodl2man, so only the .5 is installed), without which an admin is never told the form that activates the fix; and add testsuite/cve-2026-70463.test
- CVE-2026-70463
- SECURITY UPDATE: daemon filter-merge bypass of the module filter list
- debian/patches/CVE-2026-53786.patch: in parse_filter_file(), strip the module_dir prefix that parse_merge_name() prepended before checking a client-supplied --filter merge file against daemon_filter_list, so the anchored module-relative daemon rule can match; the strip is conditional on the prefix really being present so the daemon's own "include from" / "exclude from" and get_cvs_excludes() paths are not truncated; upstream's early return on a daemon-filter hit is deliberately not taken, since without v3.5.0's daemon_config_filter_file exemption it would silently drop the operator's own "include from" / "exclude from" rules and, without v3.5.0's name+errno suppression, would leave hidden merge files silent while missing ones stay fatal; add testsuite/cve-2026-53786.test
- CVE-2026-53786
- SECURITY UPDATE: daemon NULL dereference on a non-directory first
file-list entry
- debian/patches/CVE-2026-70459.patch: reject a "." or "/." transfer-root entry whose mode is not a directory in recv_file_entry(), and require dir_flist to actually hold an entry in recv_file_list() before trusting parent_ndx 0, closing the wild-pointer read that crashes the per-connection daemon child
- CVE-2026-70459
- SECURITY UPDATE: --delete scope widening via implied-parent
reclassification
- debian/patches/CVE-2026-53789.patch: add is_implied_parent_dir() to exclude.c and use it in recv_file_entry() to force an implied parent back to the honest XMIT_TOP_DIR | XMIT_NO_CONTENT_DIR encoding, on both the protocol >= 30 and the legacy protocol < 30 paths, so it lands in FLAG_IMPLIED_DIR and delete_in_dir() cannot sweep pre-existing siblings outside the intended destination subtree
- debian/patches/CVE-2022-29154-2.patch: drop the trailing slash in add_implied_include(), completing the upstream CVE-2022-29154 series this branch carries, so a "src/dir/" argument seeds the requested leaf as a plain include rule instead of a FILTRULE_DIRECTORY one; without it is_implied_parent_dir() would classify the explicitly requested directory as an implied parent and --delete would stop pruning it
- CVE-2026-53789
- SECURITY UPDATE: "auth users" authorization bypass on entries containing
a space
- References