{ "document": { "aggregate_severity": { "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "* SECURITY UPDATE: peer-driven one-byte heap out-of-bounds write in\n add_implied_include() from a files-from entry carrying both an interior\n and a trailing backslash:\n - debian/patches/els/0009-CVE-2026-70461.patch: count a trailing\n backslash when sizing the appended-wildcard pattern.\n - CVE-2026-70461.\n * SECURITY UPDATE: heap out-of-bounds write in read_args() when the peer's\n argument count lands exactly on the argv allocation:\n - debian/patches/els/0010-CVE-2026-70456.patch: reserve room for the\n trailing NULL terminator.\n - CVE-2026-70456.\n * SECURITY UPDATE: out-of-bounds write from a file entry marked\n FLAG_HLINKED that the receiver accepted with hard-link preservation\n inactive:\n - debian/patches/els/0011-CVE-2026-70458.patch: gate FLAG_HLINKED on\n preserve_hard_links and exclude directories.\n - CVE-2026-70458.\n * SECURITY UPDATE: sender-side out-of-bounds read driven by a malicious\n receiver's checksum header with a non-zero block count and a zero block\n length:\n - debian/patches/els/0012-CVE-2026-53792.patch: reject a zero block\n length in read_sum_head().\n - CVE-2026-53792.\n * SECURITY UPDATE: CPU exhaustion in the sending process via\n quadratic-time behaviour in hash_search(), driven by a malicious\n receiver's crafted equal-weak-checksum block list. The attacker is the\n receiver, but the cycles burned are the sender's: hash_search() is\n reached only through match_sums(), whose sole caller is send_files() in\n sender.c. NVD's text attributes the CPU to the receiver; the direction\n stated here is what the code does:\n - debian/patches/els/0013-CVE-2026-70453.patch: bound the per-offset\n chain walk.\n - CVE-2026-70453.\n * SECURITY UPDATE: daemon \"hosts deny\" failing open when a configured\n hostname token cannot be resolved:\n - debian/patches/els/0014-CVE-2026-70452.patch: treat an unresolvable\n deny-list token as a match.\n - CVE-2026-70452.\n * SECURITY UPDATE: daemon \"auth users\" ignoring its documented comma-only\n parsing, silently discarding a deny rule that names a group whose name\n contains a space:\n - debian/patches/els/0015-CVE-2026-70463.patch: parse the list with\n conf_strtok().\n - CVE-2026-70463.\n * SECURITY UPDATE: peer-supplied MSG_IO_TIMEOUT disabling the client's own\n I/O timeout through a non-positive or overflowing value:\n - debian/patches/els/0016-CVE-2026-70462.patch: cap the received value\n and make set_io_timeout() arithmetic overflow-safe.\n - CVE-2026-70462.\n * SECURITY UPDATE: client-supplied --filter merge file bypassing the daemon\n module filter list:\n - debian/patches/els/0017-CVE-2026-53786.patch: strip the module-dir\n prefix before the daemon-filter check.\n - CVE-2026-53786.\n * SECURITY UPDATE: per-connection daemon child crash on a crafted first\n incremental file list whose transfer root is a non-directory dot entry:\n - debian/patches/els/0018-CVE-2026-70459.patch: reject a non-directory\n transfer-root entry and require a dir_flist entry before trusting\n parent_ndx 0.\n - CVE-2026-70459.\n * SECURITY UPDATE: malicious sender widening the receiver's --delete scope\n beyond the destination subtree via implied-parent reclassification:\n - debian/patches/els/0019-CVE-2026-53789.patch: force implied-parent\n directories non-content on the receiver, including the synthetic\n transfer root and the pre-protocol-30 encoding.\n - CVE-2026-53789.\n * SECURITY UPDATE: unauthenticated pre-transfer handshake stall holding a\n per-connection daemon child past the module's max connections limit:\n - debian/patches/els/0020-CVE-2026-70464.patch: bound every\n peer-controlled handshake read with an absolute deadline and cap the\n early-protocol argument count.\n - CVE-2026-70464.\n * SECURITY UPDATE: command and argument injection through the\n RSYNC_CONNECT_PROG %H host substitution, through unquoted arguments in a\n --write-batch replay script, and through remote-shell argument quoting\n that did not escape the newline, the carriage return or the backtick:\n - debian/patches/els/0021-CVE-2026-53790.patch: shell-quote and validate\n the connect host, and quote every replay-script argument.\n - debian/patches/els/0025-CVE-2026-53790-safe-arg-shell-chars.patch: add\n the newline, the carriage return and the backtick to safe_arg()'s\n SHELL_CHARS escape set. safe_arg() escapes metacharacters because the\n remote end is reached as \"ssh rsync --server ...\", where ssh\n joins the command words and the remote sshd hands the string to the\n remote user's login shell, which re-parses it; an unescaped newline\n therefore ended the transfer command and ran what followed, and an\n unescaped backtick opened a command substitution. This package\n acquired safe_arg() from els/0001-CVE-2022-29154.patch, whose donor\n predates the backtick's addition upstream.\n - Partial fix: the daemon %RSYNC_*% exec-hook expansions do not exist in\n 3.1.3 and rsync-ssl is not installed by debian/rules, so those two of\n the four sinks named in the advisory are not present in this package.\n - CVE-2026-53790.\n * SECURITY UPDATE: further out-of-bounds F_SUM() reads where the checksum\n extra slot was never reserved -- a daemon sender with \"%C\" in its log\n format, a hard-linked non-regular entry compared against a basis dir,\n and \"%C\" on a deletion:\n - debian/patches/els/0022-CVE-2026-70458.patch: set\n sender_keeps_checksum in start_server(), require S_ISREG(file->mode)\n before the content compare in hard_link_check(), and skip the\n checksum for an ITEM_DELETED entry.\n - CVE-2026-70458.\n * Drop two peer-reachable assert() aborts (no CVE assigned; carried from\n the same upstream commit as several of the fixes above, and live in the\n shipped binary because nothing in the build defines NDEBUG):\n - debian/patches/els/0023-peer-reachable-asserts.patch: turn an\n undeclared cross-flist hard-link gnum into a protocol error instead of\n an assert, and stop asserting !is_utf8 when a daemon receiver\n forwards a peer message to the generator.\n * Bound merge-file include recursion (no CVE assigned; the remaining\n peer-reachable crash hunk of the same upstream commit several of the\n fixes above come from). A merge file's content may name another merge\n file, so parse_filter_file() re-enters itself with a BIGPATHBUFLEN\n stack buffer per level; a self-referencing per-directory merge file,\n whose content the peer supplies through the transferred tree, recursed\n until the stack was exhausted (SIGSEGV):\n - debian/patches/els/0024-merge-file-depth-cap.patch: add\n MAX_MERGE_DEPTH and a nesting counter.\n * Add committed regression tests to the shipped test suite for the six\n fixes that a black-box test can observe, each carried by the patch it\n proves and each failing without that patch:\n - testsuite/cve-2026-70452.test (els/0014), an unresolvable \"hosts deny\"\n token must deny.\n - testsuite/cve-2026-70463.test (els/0015), the first word of a\n space-bearing \"auth users\" entry must not become an allow rule.\n - testsuite/cve-2026-53786.test (els/0017), a daemon filter rule must\n govern a client merge file, and an \"exclude from\" path that only shares\n the module path's textual prefix must not be truncated.\n - testsuite/cve-2026-53790.test (els/0021), a newline-bearing filter rule\n must not reach the replay script and an injected RSYNC_CONNECT_PROG %H\n host must not execute.\n - testsuite/cve-2026-53790-shell-chars.test (els/0025), a newline, a\n carriage return or a backtick in a path must not execute a command on\n the remote shell, and an ordinary transfer over the same remote shell\n must still work.\n - testsuite/cve-2026-70458.test (els/0022), the daemon's logged \"%C\" must\n be the file's checksum, not adjacent pool memory.\n - testsuite/merge-depth.test (els/0024), a self-referencing merge file\n must be refused, not crash the process.\n - testsuite/cve-2026-53790-safe-arg-uninit.test (els/0027), a trailing\n backslash in a path must reach the remote shell doubled, and no stray\n byte may follow a path that carries a backslash.\n * SECURITY UPDATE: safe_arg() sized its result one byte larger than it\n wrote for every backslash that precedes a wildcard and for a trailing\n backslash, so the closing NUL landed past the last byte written and\n uninitialised heap was returned inside the string handed to the remote\n shell (--protect-args is off by default in 3.1.3). The same defect left a\n trailing backslash unescaped there, where it escapes the following space\n and joins the next word:\n - debian/patches/els/0027-CVE-2026-53790-safe-arg-uninit.patch: make the\n escape counter mirror the writer and guard the WILD_CHARS lookup with\n f[1]. Upstream's own stable-branch backport (1aef79e1 on\n v3.2.7-sec-patches3, from 22efd249), applied unchanged.\n - CVE-2026-53790.\n * SECURITY UPDATE: a fourth out-of-bounds F_SUM() read, specific to this\n package. generator.c unchanged_file() guards the checksum compare on the\n destination's on-disk mode while the slot is reserved from the\n peer-supplied file->mode; Debian's copy-devices.diff lets a device entry\n reach it, so with -c --copy-devices a sender's device entry whose\n destination is an existing regular file reads below its pool slot:\n - debian/patches/els/0030-CVE-2026-70458-copy-devices.patch: require\n S_ISREG(file->mode) as well.\n - CVE-2026-70458.\n * Carry the four remaining hunks of upstream 3eeedf8d that land in\n functions this series already patches (no CVE assigned; the same\n malicious-peer hardening commit seven of the patches above cite):\n - debian/patches/els/0026-donor-parity-3eeedf8d.patch: re-check the block\n length before adopting want_i in hash_search(), clamp a peer-supplied\n s->flength to the local length in match_sums(), and refuse a sub-flist\n that arrives after the final flist was freed or that names a cleared\n dir_flist slot in recv_file_list().\n * Fix secure_relative_open() never returning a directory descriptor. The\n per-component walk only assigned the result in its ENOTDIR arm, so a\n path that resolved to a directory fell through to \"errno = EINVAL\" and\n returned -1. Every permission change on a daemon receiver running with\n \"use chroot = no\" therefore failed with \"failed to set permissions ...\n Invalid argument (22)\" and the transfer exited 23. Introduced by\n els/0006-CVE-2026-29518.patch, which added both the helper and its\n O_DIRECTORY callers:\n - debian/patches/els/0029-secure-relative-open-dirfd.patch.\n * Run the upstream testsuite during the build, so the regression tests\n above are load-bearing:\n - debian/patches/els/0028-testsuite-harness.patch: add the missing\n syscall.o stubs (noatime, am_daemon, am_chrooted) to tls.c,\n trimslash.c and t_unsafe.c, without which \"make check\" could not even\n link its helper programs, and let runtests.sh honour a $skiptests list.\n - debian/rules: run \"make check\" from build-stamp unless\n DEB_BUILD_OPTIONS=nocheck, excluding devices and devices-fake, which\n fail identically on 3.1.3 with only the Debian patches applied.", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/debian10els/advisories/2026/clsa-2026_1788335736.json" } ], "tracking": { "current_release_date": "2026-09-02T07:57:20Z", "generator": { "date": "2026-09-02T07:57:20Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1788335736", "initial_release_date": "2026-09-02T07:57:20Z", "revision_history": [ { "date": "2026-09-02T07:57:20Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "Fix of 13 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian 10", "product": { "name": "Debian 10", "product_id": "Debian-10", "product_identification_helper": { "cpe": "cpe:2.3:o:debian:debian_linux:10:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Debian" } ], "category": "vendor", "name": "Software in the Public Interest, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "rsync-0:3.1.3-6+tuxcare.els5.amd64", "product": { "name": "rsync-0:3.1.3-6+tuxcare.els5.amd64", "product_id": "rsync-0:3.1.3-6+tuxcare.els5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/rsync@3.1.3-6%2Btuxcare.els5?arch=amd64" } } }, { "category": "product_version", "name": "rsync-0:3.1.3-6+tuxcare.els4.amd64", "product": { "name": "rsync-0:3.1.3-6+tuxcare.els4.amd64", "product_id": "rsync-0:3.1.3-6+tuxcare.els4.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/rsync@3.1.3-6%2Btuxcare.els4?arch=amd64" } } }, { "category": "product_version", "name": "rsync-0:3.1.3-6+tuxcare.els3.amd64", "product": { "name": "rsync-0:3.1.3-6+tuxcare.els3.amd64", "product_id": "rsync-0:3.1.3-6+tuxcare.els3.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/rsync@3.1.3-6%2Btuxcare.els3?arch=amd64" } } }, { "category": "product_version", "name": "rsync-0:3.1.3-6+tuxcare.els2.amd64", "product": { "name": "rsync-0:3.1.3-6+tuxcare.els2.amd64", "product_id": "rsync-0:3.1.3-6+tuxcare.els2.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/rsync@3.1.3-6%2Btuxcare.els2?arch=amd64" } } }, { "category": "product_version", "name": "rsync-0:3.1.3-6+tuxcare.els1.amd64", "product": { "name": "rsync-0:3.1.3-6+tuxcare.els1.amd64", "product_id": "rsync-0:3.1.3-6+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/rsync@3.1.3-6%2Btuxcare.els1?arch=amd64" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.1.3-6+tuxcare.els5.amd64 as a component of Debian 10", "product_id": "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" }, "product_reference": "rsync-0:3.1.3-6+tuxcare.els5.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.1.3-6+tuxcare.els4.amd64 as a component of Debian 10", "product_id": "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" }, "product_reference": "rsync-0:3.1.3-6+tuxcare.els4.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.1.3-6+tuxcare.els3.amd64 as a component of Debian 10", "product_id": "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64" }, "product_reference": "rsync-0:3.1.3-6+tuxcare.els3.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.1.3-6+tuxcare.els2.amd64 as a component of Debian 10", "product_id": "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64" }, "product_reference": "rsync-0:3.1.3-6+tuxcare.els2.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.1.3-6+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64" }, "product_reference": "rsync-0:3.1.3-6+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-70463", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "description", "text": "rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the group name causes the parser to split the entry at the space boundary, discarding the deny rule associated with the group. An authenticated user whose username or group membership would be denied by an @Group Name auth users entry can connect to a restricted module because the deny rule is silently discarded during parsing.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "known_affected": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-70463" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-pfj8-79vq-xgvr", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-pfj8-79vq-xgvr" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-authorization-bypass-via-auth-users-directive-parsing", "url": "https://www.vulncheck.com/advisories/rsync-authorization-bypass-via-auth-users-directive-parsing" } ], "release_date": "2026-08-13T15:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-02T07:55:40.189661Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736" }, { "category": "none_available", "date": "2026-08-13T15:20:00Z", "details": "Affected", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-53792", "cwe": { "id": "CWE-129", "name": "Improper Validation of Array Index" }, "notes": [ { "category": "description", "text": "rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially crafted checksum set containing a zero-length block to cause a negative offset calculation during delta computation, resulting in an out-of-bounds read of file data buffer memory on the sender side.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "known_affected": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53792" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-cg57-rp9g-56hw", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-cg57-rp9g-56hw" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-out-of-bounds-read-via-zero-length-checksum-block", "url": "https://www.vulncheck.com/advisories/rsync-out-of-bounds-read-via-zero-length-checksum-block" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-02T07:55:40.189661Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-70456", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one slot beyond the allocation boundary, corrupting adjacent heap memory.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "known_affected": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-70456" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-78jc-79jv-v6rw", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-78jc-79jv-v6rw" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-read-args", "url": "https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-read-args" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-02T07:55:40.189661Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-53786", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "description", "text": "rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "known_affected": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53786" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-mrc3-6cwx-hch6", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-mrc3-6cwx-hch6" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-filter-rule-bypass-via-filter-merge-directive", "url": "https://www.vulncheck.com/advisories/rsync-filter-rule-bypass-via-filter-merge-directive" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-02T07:55:40.189661Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-70452", "cwe": { "id": "CWE-636", "name": "Not Failing Securely ('Failing Open')" }, "notes": [ { "category": "description", "text": "rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "known_affected": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-70452" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-6692-28cx-wpqq", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-6692-28cx-wpqq" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-access-control-bypass-via-dns-resolution-failure", "url": "https://www.vulncheck.com/advisories/rsync-access-control-bypass-via-dns-resolution-failure" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-02T07:55:40.189661Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-70453", "cwe": { "id": "CWE-407", "name": "Inefficient Algorithmic Complexity" }, "notes": [ { "category": "description", "text": "rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU resources with a modest number of crafted entries, causing a sustained denial of service.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "known_affected": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-70453" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-8x5r-mjx8-83hv", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-8x5r-mjx8-83hv" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-algorithmic-complexity-dos-via-hash-search", "url": "https://www.vulncheck.com/advisories/rsync-algorithmic-complexity-dos-via-hash-search" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-02T07:55:40.189661Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-70462", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "known_affected": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-70462" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-j9wh-5jmp-2m64", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-j9wh-5jmp-2m64" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-signed-integer-overflow-via-msg-io-timeout", "url": "https://www.vulncheck.com/advisories/rsync-signed-integer-overflow-via-msg-io-timeout" } ], "release_date": "2026-08-13T15:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-02T07:55:40.189661Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736" }, { "category": "none_available", "date": "2026-08-13T15:20:00Z", "details": "Affected", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-70461", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsync daemon module by providing a files-from entry containing both an interior and trailing backslash, causing the add_implied_include() function to under-count the trailing backslash when sizing the destination buffer.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "known_affected": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-70461" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-jhxm-j4mq-3fj4", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-jhxm-j4mq-3fj4" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-files-from-entry", "url": "https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-files-from-entry" } ], "release_date": "2026-08-13T15:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-02T07:55:40.189661Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736" }, { "category": "none_available", "date": "2026-08-13T15:20:00Z", "details": "Affected", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-70458", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing F_SUM field in the file_struct layout to access memory past the end of the allocated structure, corrupting adjacent heap or stack data.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "known_affected": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-70458" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-gg3m-4m9m-268h", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-gg3m-4m9m-268h" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-flag-hlinked-handling", "url": "https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-flag-hlinked-handling" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-02T07:55:40.189661Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-53790", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "description", "text": "rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "known_affected": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53790" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-5hcf-7xxm-rmqq", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-5hcf-7xxm-rmqq" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-command-injection-via-multiple-code-paths", "url": "https://www.vulncheck.com/advisories/rsync-command-injection-via-multiple-code-paths" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-02T07:55:40.189661Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-70459", "cwe": { "id": "CWE-908", "name": "Use of Uninitialized Resource" }, "notes": [ { "category": "description", "text": "rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a directory structure pointer without verifying the entry type, resulting in an invalid or uninitialized pointer dereference that terminates the client connection.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "known_affected": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-70459" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-p4v4-qxw9-q72m", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-p4v4-qxw9-q72m" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-daemon-crash-via-malformed-file-list-entry", "url": "https://www.vulncheck.com/advisories/rsync-daemon-crash-via-malformed-file-list-entry" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-02T07:55:40.189661Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-53789", "cwe": { "id": "CWE-807", "name": "Reliance on Untrusted Inputs in a Security Decision" }, "notes": [ { "category": "description", "text": "rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and non-directory root handling to cause the receiver to delete files outside the authorized destination directory.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "known_affected": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53789" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-fxwg-7hmf-xh5q", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-fxwg-7hmf-xh5q" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-deletion-via-malicious-file-list", "url": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-deletion-via-malicious-file-list" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-02T07:55:40.189661Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-70464", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "description", "text": "rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to legitimate clients.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "known_affected": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-70464" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-hrwq-ccf7-rw5m", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-hrwq-ccf7-rw5m" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-connection-slot-exhaustion-dos-via-handshake-stall", "url": "https://www.vulncheck.com/advisories/rsync-connection-slot-exhaustion-dos-via-handshake-stall" } ], "release_date": "2026-08-13T15:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-02T07:55:40.189661Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788335736" }, { "category": "none_available", "date": "2026-08-13T15:20:00Z", "details": "Affected", "product_ids": [ "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64", "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] } ] }