{"id":"CLSA-2026-1789786148","summary":"rsync: Fix of 4 CVEs","details":"- CVE-2026-53793: confine a daemon module whose path carries a \"/./\" inner\n  boundary marker to the inner module root rather than only to the kernel\n  chroot, by widening the single predicate every confined wrapper, the secure\n  symlink handling and the directory scan test, so a symlink inside the module\n  can no longer reach a sibling that is inside the chroot but outside the\n  module; also sanitize the peer-supplied basis name on the client\n- CVE-2026-70454: require CA verification for the gnutls and stunnel backends\n  of the rsync-ssl helper and bind the server certificate to the requested\n  host, so an on-path attacker can no longer present a certificate valid for\n  another name; validate the hostname before it reaches the TLS client\n- CVE-2026-70464: bound the peer-driven daemon handshake with an absolute\n  deadline armed before any peer input is read, so an unauthenticated client\n  can no longer hold a connection slot open past \"max connections\" by\n  stalling the greeting or trickling arguments\n- NOTE, behaviour change from the CVE-2026-70454 fix: rsync-ssl is now\n  fail-closed for the backends that could not verify at all. With\n  RSYNC_SSL_TYPE=gnutls or stunnel and RSYNC_SSL_CA_CERT unset the helper\n  exits 1 instead of connecting without verification; set\n  RSYNC_SSL_ALLOW_INSECURE_GNUTLS=1 or RSYNC_SSL_ALLOW_INSECURE_STUNNEL=1 to\n  restore the old behaviour, and RSYNC_SSL_SKIP_HOSTNAME_CHECK=1 to keep CA\n  verification without the hostname binding. The default openssl path is\n  unchanged: it already verified, and still does","modified":"2026-10-26T09:30:50.408850740Z","published":"2026-10-08T18:36:31Z","upstream":["CVE-2026-53793","CVE-2026-70454","CVE-2026-70464"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1789786148.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53788"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53793"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70454"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70464"}],"affected":[{"package":{"name":"rsync","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/rsync?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-19.el9_2.tuxcare.els17"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1789786148.json"}},{"package":{"name":"rsync-daemon","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/rsync-daemon?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-19.el9_2.tuxcare.els17"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1789786148.json"}}],"schema_version":"1.9.0"}