CLSA-2026-1788951664
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1788951664.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1788951664
- Upstream
- Published
- 2026-09-09T11:01:20Z
- Modified
- 2026-10-26T09:31:58Z
- Summary
- rsync: Fix of 6 CVEs
- Details
-
- CVE-2026-53784: refuse attacker-planted symlinks when a daemon module resolves its absolute path with "use chroot = no"
- CVE-2026-53786: strip the module-dir prefix before checking a client-supplied filter merge file against the module filter list
- CVE-2026-53789: keep implied parent directories non-content so a peer cannot widen the scope of a --delete run
- CVE-2026-53803: open the batch, motd, lock, log and config files refusing attacker-planted symlinks, and refuse a non-regular --read-batch file
- CVE-2026-70459: reject a non-directory transfer-root file-list entry
- CVE-2026-70463: parse "auth users" with conf_strtok so an @Group Name entry containing a space is not torn in two
- References
-
- https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1788951664.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-53784
- https://nvd.nist.gov/vuln/detail/CVE-2026-53786
- https://nvd.nist.gov/vuln/detail/CVE-2026-53789
- https://nvd.nist.gov/vuln/detail/CVE-2026-53803
- https://nvd.nist.gov/vuln/detail/CVE-2026-70459
- https://nvd.nist.gov/vuln/detail/CVE-2026-70463