CLSA-2026-1790925399
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1790925399.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1790925399
- Upstream
- Published
- 2026-10-02T07:16:53Z
- Modified
- 2026-10-26T09:43:40Z
- Summary
- rsync: Fix of 5 CVEs
- Details
-
- CVE-2026-53793: widen the daemon path-confinement gate to cover a chrooted module whose path carries a "/./" inner boundary marker, and route the resolver trust root and do_mkdir_at through the same predicate
- CVE-2026-53796: confine the non-daemon receiver's destination chdir, refusing a destination symlink owned by another uid while still following the operator's own
- CVE-2026-70452: fail closed when a hosts-deny token cannot be resolved, so a transient DNS failure no longer admits a host the deny list names
- CVE-2026-53783: inode-pin the rrsync-validated path and root the argument handed to rsync at that pinned fd, refuse dangerous options in a restricted directory, add the --drop-D option the restricted receiver needs, and keep restricted-root paths working
- CVE-2026-70460: pin the receiver option directories a peer can pivot through rrsync
- References
-
- https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1790925399.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-53783
- https://nvd.nist.gov/vuln/detail/CVE-2026-53793
- https://nvd.nist.gov/vuln/detail/CVE-2026-53796
- https://nvd.nist.gov/vuln/detail/CVE-2026-70452
- https://nvd.nist.gov/vuln/detail/CVE-2026-70460
Affected packages
TuxCare:AlmaLinux:9.6 / rsync
Package
- Name
- rsync
- Purl
- pkg:rpm/tuxcare/rsync?distro=almalinux-9.6
TuxCare:AlmaLinux:9.6 / rsync-daemon
Package
- Name
- rsync-daemon
- Purl
- pkg:rpm/tuxcare/rsync-daemon?distro=almalinux-9.6