{"id":"CLSA-2026-1789745909","summary":"Fix CVE(s): CVE-2026-53785","details":"   * SECURITY UPDATE: Destination-tree escape via symlink following in\n     --relative implied-parent handling\n     - debian/patches/CVE-2026-53785.patch: resolve the receiver's destination\n       names one component at a time with O_NOFOLLOW|O_DIRECTORY, acting\n       against a directory fd that is held open, instead of handing the whole\n       name to the kernel to resolve; a component that is a symlink is now\n       refused rather than traversed, so nothing the receiver creates lands at\n       the symlink's target outside the destination tree; adds\n       secure_relative_dirfd(), do_mkdir_at(), do_stat_at(), do_open_at(),\n       do_rename_at(), do_symlink_at(), do_mknod_at() and do_link_at() in\n       syscall.c and routes every way the receiver creates something at a\n       destination name through them -- make_path() in util.c, the four\n       implied-parent sites in generator.c, the install-into-final-name\n       renames in util.c, rsync.c, receiver.c and generator.c, copy_file()'s\n       reopen of the destination on the cross-filesystem fallback, the\n       symlink and mknod creations in generator.c's atomic_create(), and the\n       --link-dest and -H hard links in generator.c and hlink.c; each of\n       those is its own route to the destination name, reached by a different\n       option (--temp-dir bypasses the file create entirely, --devices /\n       --specials and a transferred symlink never touch it, and --link-dest\n       installs a regular file's link from hlink.c but a non-regular file's\n       from generator.c), so confining only some of them leaves the escape\n       open; extends the existing secure_mkstemp() and secure_relative_open()\n       receiver create paths, which the CVE-2026-29518 fix gated on\n       daemon-no-chroot only, to the same confinement; the confinement covers\n       a chrooted daemon serving an inner-module \"/./\" boundary, whose module\n       root the kernel chroot does not confine, and exempts --keep-dirlinks\n       only for a local receiver, whose documented purpose is to follow a\n       symlinked destination directory -- never for a daemon or for the\n       server side of a push, where the option arrives from the peer; only\n       the confinement this CVE needs is carried, not upstream's whole-tree\n       dirfd-stack resolver, which assumes a source layout this version does\n       not have; defines am_daemon, am_chrooted, am_server, local_server and\n       keep_dirlinks in t_stub.c, which the standalone test harnesses link in\n       place of options.c and main.c, so debian/rules' check target still\n       builds; and adds testsuite/cve-2026-53785.test\n     - CVE-2026-53785","modified":"2026-10-26T09:43:51.828408273Z","published":"2026-09-18T15:38:40Z","upstream":["CVE-2026-29518","CVE-2026-53785"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1789745909.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53785"}],"affected":[{"package":{"name":"rsync","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/rsync?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3ubuntu1.3+tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1789745909.json"}}],"schema_version":"1.9.0"}