{"id":"CLSA-2026-1789029225","summary":"rsync: Fix of 6 CVEs","details":"- CVE-2026-53784: confine the daemon's absolute chdir target with a new\n  ownership-walk resolver so a planted parent symlink cannot steer a\n  \"use chroot = no\" module root outside the module\n- CVE-2026-53786: strip a real module_dir prefix before the daemon-filter\n  check on a merge-file path -- leaving the daemon's own \"include from\" /\n  \"exclude from\" paths alone -- and treat a hidden merge file as\n  non-existent\n- CVE-2026-53803: open the batch stream and replay script, motd, lock,\n  log and config files through the ownership-walk resolver, and refuse a\n  non-regular --read-batch file\n- CVE-2026-53789: clean a requested path's trailing slash and keep an\n  implied-parent directory non-content, blocking --delete widening\n- CVE-2026-70459: reject a non-directory transfer-root entry","modified":"2026-10-26T09:43:20.071716985Z","published":"2026-10-13T16:49:55Z","upstream":["CVE-2026-53784","CVE-2026-53786","CVE-2026-53789","CVE-2026-53803","CVE-2026-70459"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1789029225.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29518"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53784"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53786"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53789"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53803"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70459"}],"affected":[{"package":{"name":"rsync","ecosystem":"TuxCare:OracleLinux:6","purl":"pkg:rpm/tuxcare/rsync?distro=oraclelinux-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-12.el6.tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux6els/CLSA-2026-1789029225.json"}}],"schema_version":"1.9.0"}