{"id":"CLSA-2026-1788816257","summary":"Fix CVE(s): CVE-2026-53786, CVE-2026-53789, CVE-2026-70459, CVE-2026-70463","details":"   * SECURITY UPDATE: \"auth users\" authorization bypass on entries containing\n     a space\n     - debian/patches/CVE-2026-70463.patch: parse the \"auth users\" value with\n       conf_strtok() in auth_server(), so the documented leading-comma form\n       splits on commas alone and an \"@Group Name:deny\" entry is no longer\n       torn in two -- discarding the deny rule and creating an implicit allow\n       rule from its first word; import conf_strtok() into util.c, which this\n       version does not yet carry; document the leading-comma form in\n       rsyncd.conf.yo and in the pre-generated rsyncd.conf.5 (this tree ships\n       no yodl2man, so only the .5 is installed), without which an admin is\n       never told the form that activates the fix; and add\n       testsuite/cve-2026-70463.test\n     - CVE-2026-70463\n   * SECURITY UPDATE: daemon filter-merge bypass of the module filter list\n     - debian/patches/CVE-2026-53786.patch: in parse_filter_file(), strip the\n       module_dir prefix that parse_merge_name() prepended before checking a\n       client-supplied --filter merge file against daemon_filter_list, so the\n       anchored module-relative daemon rule can match; the strip is\n       conditional on the prefix really being present so the daemon's own\n       \"include from\" / \"exclude from\" and get_cvs_excludes() paths are not\n       truncated; upstream's early return on a daemon-filter hit is\n       deliberately not taken, since without v3.5.0's\n       daemon_config_filter_file exemption it would silently drop the\n       operator's own \"include from\" / \"exclude from\" rules and, without\n       v3.5.0's name+errno suppression, would leave hidden merge files\n       silent while missing ones stay fatal; add\n       testsuite/cve-2026-53786.test\n     - CVE-2026-53786\n   * SECURITY UPDATE: daemon NULL dereference on a non-directory first\n     file-list entry\n     - debian/patches/CVE-2026-70459.patch: reject a \".\" or \"/.\" transfer-root\n       entry whose mode is not a directory in recv_file_entry(), and require\n       dir_flist to actually hold an entry in recv_file_list() before trusting\n       parent_ndx 0, closing the wild-pointer read that crashes the\n       per-connection daemon child\n     - CVE-2026-70459\n   * SECURITY UPDATE: --delete scope widening via implied-parent\n     reclassification\n     - debian/patches/CVE-2026-53789.patch: add is_implied_parent_dir() to\n       exclude.c and use it in recv_file_entry() to force an implied parent\n       back to the honest XMIT_TOP_DIR | XMIT_NO_CONTENT_DIR encoding, on both\n       the protocol \u003e= 30 and the legacy protocol \u003c 30 paths, so it lands in\n       FLAG_IMPLIED_DIR and delete_in_dir() cannot sweep pre-existing siblings\n       outside the intended destination subtree\n     - debian/patches/CVE-2022-29154-2.patch: drop the trailing slash in\n       add_implied_include(), completing the upstream CVE-2022-29154 series\n       this branch carries, so a \"src/dir/\" argument seeds the requested leaf\n       as a plain include rule instead of a FILTRULE_DIRECTORY one; without it\n       is_implied_parent_dir() would classify the explicitly requested\n       directory as an implied parent and --delete would stop pruning it\n     - CVE-2026-53789","modified":"2026-10-26T09:43:35.249028467Z","published":"2026-09-07T21:24:31Z","upstream":["CVE-2022-29154","CVE-2026-53786","CVE-2026-53789","CVE-2026-70459","CVE-2026-70463"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1788816257.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53786"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53789"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70459"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70463"}],"affected":[{"package":{"name":"rsync","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/rsync?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3ubuntu1.3+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1788816257.json"}}],"schema_version":"1.9.0"}