CLSA-2026-1789735848
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1789735848.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1789735848
- Upstream
- Published
- 2026-09-18T12:51:03Z
- Modified
- 2026-10-26T09:43:52Z
- Summary
- Fix of 6 CVEs
- Details
-
- SECURITY UPDATE: unbounded hash-chain walk in the delta-transfer matcher
- debian/patches/CVE-2026-70453.patch: bound the hash_search() chain walk in match.c so a crafted checksum set cannot drive quadratic CPU use
- CVE-2026-70453
- SECURITY UPDATE: peer-supplied I/O timeout accepted as non-positive
- debian/patches/CVE-2026-70462.patch: reject a non-positive MSG_IO_TIMEOUT from the peer in io.c
- CVE-2026-70462
- SECURITY UPDATE: unbounded daemon pre-transfer handshake
- debian/patches/CVE-2026-70464.patch: bound the pre-transfer handshake with a timeout in clientserver.c and io.c
- CVE-2026-70464
- SECURITY UPDATE: malicious-peer protocol input and checksum-slot lifetime
- debian/patches/CVE-2026-70458-1.patch: daemon robustness against malicious-peer protocol input
- debian/patches/CVE-2026-70458-2.patch: guard the F_SUM checksum-slot lifetime in hlink.c and main.c
- debian/patches/CVE-2026-70458-3-copy-devices.patch: extend the same guard to the copy-devices path
- CVE-2026-70458
- SECURITY UPDATE: daemon authentication, access and argument hardening
- debian/patches/CVE-2026-53790-1.patch: harden daemon authentication, access, socket and argument handling
- debian/patches/CVE-2026-53790-2-shell-chars.patch: confine operator- and peer-supplied paths to the served tree and reject shell metacharacters
- debian/patches/CVE-2026-53790-3-uninit.patch: fix a safe_arg() uninitialized-byte leak in options.c
- CVE-2026-53790
- SECURITY UPDATE: inner-module escape for a daemon module using /./
- debian/patches/CVE-2026-53793-1-basis-paths.patch: stat alternate-basis candidates through the confined resolver in generator.c
- debian/patches/CVE-2026-53793-2-inner-module.patch: widen the use_secure_symlinks and change_dir() gates from "am_daemon && !am_chrooted" to "am_daemon && (!am_chrooted || module_dirlen)" so an inner module root is the trust boundary, not the kernel chroot
- CVE-2026-53793
- SECURITY UPDATE: unbounded hash-chain walk in the delta-transfer matcher
- References
-
- https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1789735848.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-53790
- https://nvd.nist.gov/vuln/detail/CVE-2026-53793
- https://nvd.nist.gov/vuln/detail/CVE-2026-70453
- https://nvd.nist.gov/vuln/detail/CVE-2026-70458
- https://nvd.nist.gov/vuln/detail/CVE-2026-70462
- https://nvd.nist.gov/vuln/detail/CVE-2026-70464