{"id":"CLSA-2026-1788815738","summary":"Fix CVE(s): CVE-2026-53786, CVE-2026-53789, CVE-2026-70459, CVE-2026-70463","details":"   * SECURITY UPDATE: authorization bypass in \"auth users\" @Group Name parsing\n     - debian/patches/CVE-2026-70463.patch: tokenise the \"auth users\" value with\n       conf_strtok() in authenticate.c, imported into util.c and declared in\n       proto.h, so a leading comma splits on commas alone and an @Group Name\n       entry containing a space is no longer torn in two and its deny rule\n       silently discarded\n     - CVE-2026-70463\n   * SECURITY UPDATE: daemon filter-merge bypass of the module filter list\n     - debian/patches/CVE-2026-53786.patch: strip module_dirlen from an absolute\n       --filter merge path in parse_filter_file() in exclude.c before checking it\n       against daemon_filter_list, so an anchored module-relative daemon rule\n       matches, and treat a merge file hidden by the daemon filter as\n       non-existent instead of a fatal error\n     - CVE-2026-53786\n   * SECURITY UPDATE: daemon NULL dereference on a non-directory transfer root\n     - debian/patches/CVE-2026-70459.patch: reject a \".\" or \"/.\" transfer-root\n       entry that is not a directory in recv_file_entry() in flist.c, instead of\n       dereferencing it as a directory structure pointer, and require\n       dir_flist to actually hold an entry in recv_file_list() before trusting\n       parent_ndx 0, closing the second route to the same uninitialised\n       dir_flist-\u003efiles[0]\n     - CVE-2026-70459\n   * SECURITY UPDATE: --delete scope widening via implied-parent reclassification\n     - debian/patches/CVE-2026-53789.patch: add is_implied_parent_dir() to\n       exclude.c and use it in recv_file_entry() in flist.c to force an implied\n       parent directory back to the honest XMIT_TOP_DIR|XMIT_NO_CONTENT_DIR\n       encoding, so it lands in FLAG_IMPLIED_DIR and delete_in_dir() cannot\n       sweep pre-existing siblings; also covers the synthetic transfer-root\n       entry and the legacy protocol \u003c 30 XMIT_TOP_DIR path\n     - CVE-2026-53789","modified":"2026-10-26T09:32:04.179882146Z","published":"2026-09-07T22:37:24Z","upstream":["CVE-2026-53786","CVE-2026-53789","CVE-2026-70459","CVE-2026-70463"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1788815738.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53786"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53789"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70459"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70463"}],"affected":[{"package":{"name":"rsync","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/rsync?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2.1ubuntu1.6+tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788815738.json"}}],"schema_version":"1.9.0"}