CLSA-2026-1789029225
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux6els/CLSA-2026-1789029225.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1789029225
- Upstream
- Published
- 2026-10-13T16:49:55Z
- Modified
- 2026-10-26T09:43:20Z
- Summary
- rsync: Fix of 6 CVEs
- Details
-
- CVE-2026-53784: confine the daemon's absolute chdir target with a new ownership-walk resolver so a planted parent symlink cannot steer a "use chroot = no" module root outside the module
- CVE-2026-53786: strip a real module_dir prefix before the daemon-filter check on a merge-file path -- leaving the daemon's own "include from" / "exclude from" paths alone -- and treat a hidden merge file as non-existent
- CVE-2026-53803: open the batch stream and replay script, motd, lock, log and config files through the ownership-walk resolver, and refuse a non-regular --read-batch file
- CVE-2026-53789: clean a requested path's trailing slash and keep an implied-parent directory non-content, blocking --delete widening
- CVE-2026-70459: reject a non-directory transfer-root entry
- References
-
- https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1789029225.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-29518
- https://nvd.nist.gov/vuln/detail/CVE-2026-53784
- https://nvd.nist.gov/vuln/detail/CVE-2026-53786
- https://nvd.nist.gov/vuln/detail/CVE-2026-53789
- https://nvd.nist.gov/vuln/detail/CVE-2026-53803
- https://nvd.nist.gov/vuln/detail/CVE-2026-70459