{"id":"CLSA-2026-1789466898","summary":"Fix of 7 CVEs","details":"   * SECURITY UPDATE: symlink attack on the daemon module-root chdir\n     - debian/patches/els/0031-CVE-2026-53784.patch: add\n       safe_open_no_attacker_symlinks() in util.c and confine the daemon\n       module-root chdir under use-chroot=no.  els/0006 had hardened only the\n       relative branch of change_dir(); the absolute branch was still on a\n       plain chdir(dir)\n     - CVE-2026-53784\n   * SECURITY UPDATE: information disclosure and arbitrary write via symlinks\n     planted on operator-supplied paths\n     - debian/patches/els/0032-CVE-2026-53802-CVE-2026-53803.patch: open the\n       secrets file, \"pid file\", --config, motd, --password-file, --log-file,\n       --write-batch/--read-batch and the filter, merge-file,\n       --exclude-from/--include-from paths through\n       safe_open_no_attacker_symlinks()\n     - debian/patches/els/0037-CVE-2026-53802-files-from.patch: the same for\n       --files-from, which is opened in options.c and which upstream converted\n       separately, in 3ee00e00\n     - CVE-2026-53802\n     - CVE-2026-53803\n   * SECURITY UPDATE: arbitrary file write via an absolute --temp-dir or\n     --link-dest whose parent is flipped to a symlink mid-operation\n     - debian/patches/els/0033-CVE-2026-53795.patch: confine do_rename() and\n       do_link() in syscall.c through an ownership walk on the pinned parent\n       directory fd\n     - debian/patches/els/0039-CVE-2026-53795-exdev.patch: confine the same way\n       the copy_file() opens and the do_unlink() that robust_rename() falls back\n       to when the rename returns EXDEV, i.e. when an absolute --temp-dir or\n       --partial-dir is on another filesystem (upstream bf79a2a0)\n     - CVE-2026-53795\n   * These four CVEs were previously assessed as requiring the 3.5.0 path\n     resolution rewrite (54965efc, defd7110, b62d7ed6) and closed Won't Fix.\n     That assessment was wrong for CVE-2026-53784/53802/53803: upstream fixed\n     them on 2026-06-12 in a7c49e93, f2941575, 9bfa07e3 and 62bf55fc, nine days\n     before the rewrite and independent of it.  CVE-2026-53795 does depend on\n     the rewrite; els/0033 covers only the two sinks it names and documents what\n     it leaves out\n   * SECURITY UPDATE: TOCTOU on the non-daemon receiver's destination chdir\n     - debian/patches/els/0034-CVE-2026-53796.patch: resolve the operator-named\n       destination through safe_open_no_attacker_symlinks() + fchdir, for both\n       the absolute and the relative branch of change_dir()\n     - CVE-2026-53796\n   * SECURITY UPDATE: path confinement bypass for a daemon module with a /./\n     inner boundary marker\n     - debian/patches/els/0035-CVE-2026-53793.patch: widen the four daemon\n       symlink-confinement gates from \"am_daemon && !am_chrooted\" to\n       \"am_daemon && (!am_chrooted || module_dirlen)\" so an inner module root\n       is treated as the trust boundary\n     - debian/patches/els/0040-CVE-2026-53793-basis-paths.patch: extend that\n       boundary to the two alternate-basis paths the gates do not reach -- the\n       generator's alt-dest basis stat (upstream 5ed0ab3f) and the\n       peer-supplied basis xname the receiver joins to an operator basedir\n       (upstream db284e22)\n     - CVE-2026-53793\n   * SECURITY UPDATE: symlink race in the non-daemon sender's source traversal\n     - debian/patches/els/0036-CVE-2026-53797.patch: open file content through\n       secure_relative_open() anchored at the transfer root under default\n       symlink handling, so a raced parent symlink cannot redirect the read\n     - debian/patches/els/0038-CVE-2026-53797-noatime.patch: apply O_NOATIME in\n       secure_relative_open() as do_open() did, so --noatime keeps working on\n       that open (and on the els/0006 daemon-sender one)\n     - CVE-2026-53797\n   * The three above come from openSUSE's backport of the same upstream commits\n     to rsync 3.2.3 (openSUSE:Leap:15.5:Update/rsync.45907, hardening patches\n     0108, 0107 and 0100).  Four further CVEs from this disclosure remain open\n     against the package and are NOT addressed: CVE-2026-53785, CVE-2026-53801\n     and CVE-2026-70460 need the 3.5.0 held-dirfd resolver (upstream 3dddbde5;\n     openSUSE 0093/0094/0101 pull in held_dfd_for, link_stat_at, do_mkdir_at\n     and do_chmod_atfd), and CVE-2026-53799 needs the fd-based ACL/xattr family\n     (openSUSE 0118-0124, ~3300 lines incl. libacl and configure work)\n   * els/0037-0040 answer the code review of GitLab MR\n     secure-libraries/els-os/rsync!30: two of them close real gaps in the\n     patches above (--files-from, the EXDEV fallback), one restores --noatime,\n     and one completes the inner-module boundary.  Each is a distinct upstream\n     commit, so each is a distinct patch rather than an edit of the patch it\n     follows\n   * The upstream regression tests named in the patch headers are not carried:\n     upstream ships them only as pytest testsuite/*_test.py files and 3.1.3 has\n     no pytest harness","modified":"2026-10-26T09:43:56.132739970Z","published":"2026-09-15T10:08:34Z","upstream":["CVE-2026-53784","CVE-2026-53785","CVE-2026-53793","CVE-2026-53795","CVE-2026-53796","CVE-2026-53797","CVE-2026-53799","CVE-2026-53801","CVE-2026-53802","CVE-2026-53803","CVE-2026-70460"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1789466898.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53784"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53793"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53795"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53796"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53797"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53802"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53803"}],"affected":[{"package":{"name":"rsync","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/rsync?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-6+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1789466898.json"}}],"schema_version":"1.9.0"}