CLSA-2026-1792766755
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux6els/CLSA-2026-1792766755.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1792766755
- Upstream
CVE (2)
- Published
- 2026-10-23T14:46:06Z
- Modified
- 2026-10-26T09:43:46Z
- Summary
- rsync: Fix of CVE-2026-53802
- Details
-
- CVE-2026-53783: harden the support/rrsync wrapper: refuse paths that resolve outside the restricted directory, refuse -L/-k/-K and --copy-unsafe-links there, hand the transfer arguments and the receiver's directory options to rsync as held directories, stop path arguments being parsed as options, open rrsync.log without following a symlink; add --drop-D so a restricted receiver does not create devices or special files, and --confine-root so rsync refuses names that leave the restricted directory, including --files-from lines and merge files
- CVE-2026-53802: open the daemon secrets file, the client --password-file, --files-from and the --filter merge / per-directory merge files refusing attacker-planted symlinks -- confined beneath the module root on a daemon, owner-trust walk otherwise; secrets and password files are checked with fstat() of the opened fd; /dev/fd, /dev/stdin and <(...) keep working
- References