{"id":"CLSA-2026-1788959958","summary":"rsync: Fix of 3 CVEs","details":"- CVE-2026-53784: daemon module-root chdir escape under `use chroot = no`\n  because change_dir() reached the module path with a plain chdir(), which\n  followed a planted parent-component symlink and served files from outside\n  the module; the module-root chdir now resolves through an ownership-checked\n  O_NOFOLLOW path walk\n- CVE-2026-53802: arbitrary file read via symlinked operator-supplied input\n  paths because --filter merge files (including per-directory merges and -C\n  .cvsignore), --files-from/--include-from/--exclude-from and the\n  --password-file / daemon secrets file were opened by path, letting a planted\n  symlink feed an arbitrary file to the filter parser or the authentication\n  response; these now use the same ownership-checked path walk\n- CVE-2026-53803: arbitrary file write via symlinked operator-supplied output\n  paths because --log-file, --write-batch/--read-batch and the daemon motd,\n  lock and --config opens resolved by path, letting a planted symlink redirect\n  a privileged write; these now use the same ownership-checked path walk, and\n  --read-batch additionally requires a regular file or a FIFO\n- Note: the ownership-checked path walk opens each intermediate directory\n  for reading, where plain path resolution needed only search permission,\n  so an operator path under a search-only (e.g. 0711) ancestor that the\n  caller cannot read is now refused: --log-file falls back to syslog with\n  a warning and --exclude-from fails. This matches upstream behaviour.","modified":"2026-10-26T09:30:54.906716995Z","published":"2026-09-09T13:19:31Z","upstream":["CVE-2026-53784","CVE-2026-53802","CVE-2026-53803"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1788959958.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53784"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53802"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53803"}],"affected":[{"package":{"name":"rsync","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/rsync?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-19.el8.1.tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2026-1788959958.json"}},{"package":{"name":"rsync-daemon","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/rsync-daemon?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-19.el8.1.tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2026-1788959958.json"}}],"schema_version":"1.9.0"}