{"id":"CLSA-2026-1792659934","summary":"rsync: Fix of CVE-2026-53783","details":"- CVE-2026-53783: fix a TOCTOU escape from rrsync's restricted directory by\n  replacing the lexical-only Perl support/rrsync with upstream's Python one,\n  which pins each validated path component through /proc/self/fd, fails closed\n  on path anomalies, pins the receiver option directories a peer can pivot\n  (--backup-dir, --partial-dir, alt-dest) and denies --copy-unsafe-links,\n  device/special creation, a peer-selected --debug, remote --files-from in\n  write-only mode and the no-overwrite auxiliary paths inside a restricted dir\n- NOTE: the replacement needs the new --drop-D option, backported from upstream\n  b607369f; it makes a receiver refuse to create devices and special files\n  without changing the file-list encoding the way --no-D does. support/ keeps\n  shipping as non-executable documentation, so no installed program changes\n  behaviour unless an operator has wired rrsync as an SSH forced command.\n  rrsync is now Python rather than Perl\n- NOTE: one receiver-side spelling differs from upstream deliberately: a\n  destination that already exists and is not a directory is pinned by its\n  parent rather than by itself, because rsync replaces such a destination by\n  unlinking its name, which the self-pin spelling cannot support -- without\n  this, pushing a file onto an existing file through rrsync failed. Path\n  components above the destination stay pinned either way","modified":"2026-10-26T09:31:01.977654458Z","published":"2026-10-22T09:05:45Z","upstream":["CVE-2026-53783"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792659934.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53783"}],"affected":[{"package":{"name":"rsync","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/rsync?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-19.el9_2.tuxcare.els22"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792659934.json"}},{"package":{"name":"rsync-daemon","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/rsync-daemon?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-19.el9_2.tuxcare.els22"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792659934.json"}}],"schema_version":"1.9.0"}