{"id":"CLSA-2026-1788799362","summary":"Fix of 7 CVEs","details":"   * SECURITY UPDATE: symlink attacks on daemon operator-supplied paths\n     - debian/patches/CVE-2026-53784.patch: add\n       safe_open_no_attacker_symlinks() in util.c and confine the daemon\n       module-root chdir under use-chroot=no\n     - CVE-2026-53784\n   * SECURITY UPDATE: information disclosure via planted symlinks\n     - debian/patches/CVE-2026-53802-CVE-2026-53803.patch: open the secrets\n       file, --password-file, batch, log, config and exclude/include files\n       through safe_open_no_attacker_symlinks()\n     - CVE-2026-53802\n     - CVE-2026-53803\n   * SECURITY UPDATE: information disclosure via symlinked filter/merge files\n     - debian/patches/CVE-2026-53786.patch: open filter and per-directory merge\n       files through safe_open_no_attacker_symlinks() and treat a merge file\n       hidden by the daemon filter as absent\n     - CVE-2026-53786\n   * SECURITY UPDATE: arbitrary file write via absolute --temp-dir/--link-dest\n     - debian/patches/CVE-2026-53795.patch: confine do_rename() and do_link()\n       in syscall.c through an ownership walk on the pinned parent directory fd\n     - CVE-2026-53795\n   * SECURITY UPDATE: daemon crash via a malformed file list entry\n     - debian/patches/CVE-2026-70459.patch: reject a non-directory\n       transfer-root entry and bound parent_ndx in flist.c, generator.c and\n       receiver.c\n     - CVE-2026-70459\n   * SECURITY UPDATE: \"auth users\" entries parsed on whitespace\n     - debian/patches/CVE-2026-70463.patch: parse the daemon's \"auth users\"\n       list with conf_strtok() in authenticate.c so it splits on commas alone\n     - CVE-2026-70463\n   * The non-directory transfer-root guard shipped in +tuxcare.els5 under\n     debian/patches/CVE-2026-53789.patch now lives in\n     debian/patches/CVE-2026-70459.patch, no functional change\n   * The upstream regression tests named in the patch headers are not carried:\n     upstream ships them only as pytest testsuite/*_test.py files and 3.1.3\n     has no pytest harness","modified":"2026-10-26T09:43:25.000801651Z","published":"2026-09-07T16:42:56Z","upstream":["CVE-2026-53784","CVE-2026-53786","CVE-2026-53789","CVE-2026-53795","CVE-2026-53802","CVE-2026-53803","CVE-2026-70459","CVE-2026-70463"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1788799362.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53784"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53786"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53795"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53802"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53803"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70459"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70463"}],"affected":[{"package":{"name":"rsync","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/rsync?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-8ubuntu0.9+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1788799362.json"}}],"schema_version":"1.9.0"}