{"id":"CLSA-2026-1780486587","summary":"rsync: Fix of CVE-2026-43619","details":"- CVE-2026-43619: secure receiver-side path-based syscalls (do_chmod,\n  do_lchown, do_rename, do_unlink, do_mkdir, do_symlink, do_mknod,\n  do_link, do_rmdir, do_utimensat, do_lstat) against symlink-race\n  TOCTOU by routing through secure_relative_open + *at() wrappers,\n  harden secure_relative_open to reject .. components and confine\n  relative basedir, secure change_dir against chdir-escape, secure\n  copy_file source/dest opens, fix absolute --partial-dir delta\n  resume via secure_basis_open; add alt-dest-symlink-race /\n  bare-do-open-symlink-race / copy-dest-source-symlink /\n  secure-relpath-validation tests","modified":"2026-10-26T09:30:17.577202703Z","published":"2026-06-03T11:38:40Z","upstream":["CVE-2026-43619"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1780486587.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43619"}],"affected":[{"package":{"name":"rsync","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/rsync?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-19.el9_2.tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1780486587.json"}},{"package":{"name":"rsync-daemon","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/rsync-daemon?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-19.el9_2.tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1780486587.json"}}],"schema_version":"1.9.0"}