{"id":"CLSA-2026-1788888956","summary":"rsync: Fix of 3 CVEs","details":"- CVE-2026-53786: strip the module dir back off a --filter merge file path\n  before the daemon_filter_list check so an anchored module-relative daemon\n  rule matches and a hidden merge file cannot be pulled in\n- CVE-2026-53795: confine each side of do_rename_at() and do_link_at()\n  independently so an absolute --temp-dir or --link-dest cannot switch off\n  confinement and redirect the final rename out of the destination tree\n- CVE-2026-53802: route the secrets file, --password-file, the filter and\n  merge files and --files-from through open_no_attacker_symlinks() and fstat\n  the descriptor so a planted symlink cannot leak a root-readable file","modified":"2026-10-26T09:30:45.044346436Z","published":"2026-09-08T17:36:07Z","upstream":["CVE-2026-53786","CVE-2026-53795","CVE-2026-53802"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1788888956.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53786"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53795"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53802"}],"affected":[{"package":{"name":"rsync","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/rsync?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-19.el9_2.tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1788888956.json"}},{"package":{"name":"rsync-daemon","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/rsync-daemon?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-19.el9_2.tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1788888956.json"}}],"schema_version":"1.9.0"}