{"id":"CLSA-2026-1788955971","summary":"Fix CVE(s): CVE-2026-53784, CVE-2026-53802, CVE-2026-53803","details":"   * SECURITY UPDATE: daemon module-root chdir escape under `use chroot = no`\n     - debian/patches/CVE-2026-53784.patch: add safe_open_no_attacker_symlinks()\n       to util.c and route change_dir()'s daemon module-root chdir through it, so\n       a planted parent-component symlink no longer moves the daemon's CWD\n       outside the module; a symlink is followed only when owned by uid 0 or our\n       euid\n     - CVE-2026-53784\n   * SECURITY UPDATE: arbitrary file read via symlinked operator input paths\n     - debian/patches/CVE-2026-53802.patch: open --filter merge files (including\n       per-directory merges and -C .cvsignore), --files-from/--include-from/\n       --exclude-from (exclude.c) and the --password-file / daemon secrets file\n       (authenticate.c) through the same ownership-checked walk, so a planted\n       symlink cannot feed an arbitrary file to the filter parser or the\n       authentication response\n     - CVE-2026-53802\n   * SECURITY UPDATE: arbitrary file write via symlinked operator output paths\n     - debian/patches/CVE-2026-53803.patch: open --log-file (log.c), the\n       --write-batch/--read-batch files (batch.c and main.c) and the daemon motd,\n       lock and --config paths (clientserver.c, connection.c, params.c) through\n       the same ownership-checked walk, so a planted symlink cannot redirect a\n       privileged write, and require --read-batch to name a regular file or a FIFO\n     - CVE-2026-53803\n   * NOTE: the ownership-checked path walk opens each intermediate directory\n     for reading, where plain path resolution needed only search permission,\n     so an operator path under a search-only (e.g. 0711) ancestor that the\n     caller cannot read is now refused: --log-file falls back to syslog with\n     a warning and --exclude-from fails. This matches upstream behaviour.","modified":"2026-10-26T09:32:03.918060455Z","published":"2026-09-09T12:13:04Z","upstream":["CVE-2026-53784","CVE-2026-53802","CVE-2026-53803"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1788955971.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53784"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53802"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53803"}],"affected":[{"package":{"name":"rsync","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/rsync?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2.1ubuntu1.6+tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788955971.json"}}],"schema_version":"1.9.0"}