CLSA-2026-1788955971
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788955971.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1788955971
- Upstream
- Published
- 2026-09-09T12:13:04Z
- Modified
- 2026-10-26T09:32:03Z
- Summary
- Fix CVE(s): CVE-2026-53784, CVE-2026-53802, CVE-2026-53803
- Details
-
- SECURITY UPDATE: daemon module-root chdir escape under
use chroot = no- debian/patches/CVE-2026-53784.patch: add safe_open_no_attacker_symlinks() to util.c and route change_dir()'s daemon module-root chdir through it, so a planted parent-component symlink no longer moves the daemon's CWD outside the module; a symlink is followed only when owned by uid 0 or our euid
- CVE-2026-53784
- SECURITY UPDATE: arbitrary file read via symlinked operator input paths
- debian/patches/CVE-2026-53802.patch: open --filter merge files (including per-directory merges and -C .cvsignore), --files-from/--include-from/ --exclude-from (exclude.c) and the --password-file / daemon secrets file (authenticate.c) through the same ownership-checked walk, so a planted symlink cannot feed an arbitrary file to the filter parser or the authentication response
- CVE-2026-53802
- SECURITY UPDATE: arbitrary file write via symlinked operator output paths
- debian/patches/CVE-2026-53803.patch: open --log-file (log.c), the --write-batch/--read-batch files (batch.c and main.c) and the daemon motd, lock and --config paths (clientserver.c, connection.c, params.c) through the same ownership-checked walk, so a planted symlink cannot redirect a privileged write, and require --read-batch to name a regular file or a FIFO
- CVE-2026-53803
- NOTE: the ownership-checked path walk opens each intermediate directory for reading, where plain path resolution needed only search permission, so an operator path under a search-only (e.g. 0711) ancestor that the caller cannot read is now refused: --log-file falls back to syslog with a warning and --exclude-from fails. This matches upstream behaviour.
- SECURITY UPDATE: daemon module-root chdir escape under
- References