CLSA-2026-1792659934
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792659934.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1792659934
- Upstream
- Published
- 2026-10-22T09:05:45Z
- Modified
- 2026-10-26T09:31:01Z
- Summary
- rsync: Fix of CVE-2026-53783
- Details
-
- CVE-2026-53783: fix a TOCTOU escape from rrsync's restricted directory by replacing the lexical-only Perl support/rrsync with upstream's Python one, which pins each validated path component through /proc/self/fd, fails closed on path anomalies, pins the receiver option directories a peer can pivot (--backup-dir, --partial-dir, alt-dest) and denies --copy-unsafe-links, device/special creation, a peer-selected --debug, remote --files-from in write-only mode and the no-overwrite auxiliary paths inside a restricted dir
- NOTE: the replacement needs the new --drop-D option, backported from upstream b607369f; it makes a receiver refuse to create devices and special files without changing the file-list encoding the way --no-D does. support/ keeps shipping as non-executable documentation, so no installed program changes behaviour unless an operator has wired rrsync as an SSH forced command. rrsync is now Python rather than Perl
- NOTE: one receiver-side spelling differs from upstream deliberately: a destination that already exists and is not a directory is pinned by its parent rather than by itself, because rsync replaces such a destination by unlinking its name, which the self-pin spelling cannot support -- without this, pushing a file onto an existing file through rrsync failed. Path components above the destination stay pinned either way
- References
Affected packages
TuxCare:AlmaLinux:9.2 / rsync
Package
- Name
- rsync
- Purl
- pkg:rpm/tuxcare/rsync?distro=almalinux-9.2