{"id":"CLSA-2026-1792766755","summary":"rsync: Fix of CVE-2026-53802","details":"- CVE-2026-53783: harden the support/rrsync wrapper: refuse paths that\n  resolve outside the restricted directory, refuse -L/-k/-K and\n  --copy-unsafe-links there, hand the transfer arguments and the receiver's\n  directory options to rsync as held directories, stop path arguments being\n  parsed as options, open rrsync.log without following a symlink; add\n  --drop-D so a restricted receiver does not create devices or special\n  files, and --confine-root so rsync refuses names that leave the restricted\n  directory, including --files-from lines and merge files\n- CVE-2026-53802: open the daemon secrets file, the client --password-file,\n  --files-from and the --filter merge / per-directory merge files refusing\n  attacker-planted symlinks -- confined beneath the module root on a daemon,\n  owner-trust walk otherwise; secrets and password files are checked with\n  fstat() of the opened fd; /dev/fd, /dev/stdin and \u003c(...) keep working","modified":"2026-10-26T09:43:46.142806054Z","published":"2026-10-23T14:46:06Z","upstream":["CVE-2026-53783","CVE-2026-53802"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1792766755.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53802"}],"affected":[{"package":{"name":"rsync","ecosystem":"TuxCare:OracleLinux:6","purl":"pkg:rpm/tuxcare/rsync?distro=oraclelinux-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-12.el6.tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux6els/CLSA-2026-1792766755.json"}}],"schema_version":"1.9.0"}