{"id":"CLSA-2026-1792143512","summary":"rsync: Fix of CVE-2026-53785","details":"- CVE-2026-53785: create a transfer's implied parent directories and the\n  generator's directory entries through the symlink-race-safe parent walk, so\n  a symlink planted at a parent component cannot make a non-chrooted receiver\n  create them outside the destination tree\n- CVE-2026-53783: complete the els3 fix, which was partial: add --confine-root\n  so a restricted-directory server also refuses the names that arrive over the\n  protocol (file-list names, --files-from lines, filter merge files), and have\n  rrsync pass it; hand rsync a pinned receiver directory option and an existing\n  directory destination as /proc/self/fd/N/. and any other existing destination\n  as its pinned parent plus the leaf, so --partial-dir no longer discards\n  completed files and a push onto an existing file no longer fails","modified":"2026-10-26T09:43:56.529431Z","published":"2026-10-16T09:38:43Z","upstream":["CVE-2026-53783","CVE-2026-53785"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792143512.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53785"}],"affected":[{"package":{"name":"rsync","ecosystem":"TuxCare:RHEL:7","purl":"pkg:rpm/tuxcare/rsync?distro=rhel-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-12.0.5.el7_9.tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1792143512.json"}}],"schema_version":"1.9.0"}