{
  "document": {
    "aggregate_severity": {
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      },
      {
        "category": "details",
        "text": "* SECURITY UPDATE: symlink attack on the daemon module-root chdir\n     - debian/patches/els/0031-CVE-2026-53784.patch: add\n       safe_open_no_attacker_symlinks() in util.c and confine the daemon\n       module-root chdir under use-chroot=no.  els/0006 had hardened only the\n       relative branch of change_dir(); the absolute branch was still on a\n       plain chdir(dir)\n     - CVE-2026-53784\n   * SECURITY UPDATE: information disclosure and arbitrary write via symlinks\n     planted on operator-supplied paths\n     - debian/patches/els/0032-CVE-2026-53802-CVE-2026-53803.patch: open the\n       secrets file, \"pid file\", --config, motd, --password-file, --log-file,\n       --write-batch/--read-batch and the filter, merge-file,\n       --exclude-from/--include-from paths through\n       safe_open_no_attacker_symlinks()\n     - debian/patches/els/0037-CVE-2026-53802-files-from.patch: the same for\n       --files-from, which is opened in options.c and which upstream converted\n       separately, in 3ee00e00\n     - CVE-2026-53802\n     - CVE-2026-53803\n   * SECURITY UPDATE: arbitrary file write via an absolute --temp-dir or\n     --link-dest whose parent is flipped to a symlink mid-operation\n     - debian/patches/els/0033-CVE-2026-53795.patch: confine do_rename() and\n       do_link() in syscall.c through an ownership walk on the pinned parent\n       directory fd\n     - debian/patches/els/0039-CVE-2026-53795-exdev.patch: confine the same way\n       the copy_file() opens and the do_unlink() that robust_rename() falls back\n       to when the rename returns EXDEV, i.e. when an absolute --temp-dir or\n       --partial-dir is on another filesystem (upstream bf79a2a0)\n     - CVE-2026-53795\n   * These four CVEs were previously assessed as requiring the 3.5.0 path\n     resolution rewrite (54965efc, defd7110, b62d7ed6) and closed Won't Fix.\n     That assessment was wrong for CVE-2026-53784/53802/53803: upstream fixed\n     them on 2026-06-12 in a7c49e93, f2941575, 9bfa07e3 and 62bf55fc, nine days\n     before the rewrite and independent of it.  CVE-2026-53795 does depend on\n     the rewrite; els/0033 covers only the two sinks it names and documents what\n     it leaves out\n   * SECURITY UPDATE: TOCTOU on the non-daemon receiver's destination chdir\n     - debian/patches/els/0034-CVE-2026-53796.patch: resolve the operator-named\n       destination through safe_open_no_attacker_symlinks() + fchdir, for both\n       the absolute and the relative branch of change_dir()\n     - CVE-2026-53796\n   * SECURITY UPDATE: path confinement bypass for a daemon module with a /./\n     inner boundary marker\n     - debian/patches/els/0035-CVE-2026-53793.patch: widen the four daemon\n       symlink-confinement gates from \"am_daemon && !am_chrooted\" to\n       \"am_daemon && (!am_chrooted || module_dirlen)\" so an inner module root\n       is treated as the trust boundary\n     - debian/patches/els/0040-CVE-2026-53793-basis-paths.patch: extend that\n       boundary to the two alternate-basis paths the gates do not reach -- the\n       generator's alt-dest basis stat (upstream 5ed0ab3f) and the\n       peer-supplied basis xname the receiver joins to an operator basedir\n       (upstream db284e22)\n     - CVE-2026-53793\n   * SECURITY UPDATE: symlink race in the non-daemon sender's source traversal\n     - debian/patches/els/0036-CVE-2026-53797.patch: open file content through\n       secure_relative_open() anchored at the transfer root under default\n       symlink handling, so a raced parent symlink cannot redirect the read\n     - debian/patches/els/0038-CVE-2026-53797-noatime.patch: apply O_NOATIME in\n       secure_relative_open() as do_open() did, so --noatime keeps working on\n       that open (and on the els/0006 daemon-sender one)\n     - CVE-2026-53797\n   * The three above come from openSUSE's backport of the same upstream commits\n     to rsync 3.2.3 (openSUSE:Leap:15.5:Update/rsync.45907, hardening patches\n     0108, 0107 and 0100).  Four further CVEs from this disclosure remain open\n     against the package and are NOT addressed: CVE-2026-53785, CVE-2026-53801\n     and CVE-2026-70460 need the 3.5.0 held-dirfd resolver (upstream 3dddbde5;\n     openSUSE 0093/0094/0101 pull in held_dfd_for, link_stat_at, do_mkdir_at\n     and do_chmod_atfd), and CVE-2026-53799 needs the fd-based ACL/xattr family\n     (openSUSE 0118-0124, ~3300 lines incl. libacl and configure work)\n   * els/0037-0040 answer the code review of GitLab MR\n     secure-libraries/els-os/rsync!30: two of them close real gaps in the\n     patches above (--files-from, the EXDEV fallback), one restores --noatime,\n     and one completes the inner-module boundary.  Each is a distinct upstream\n     commit, so each is a distinct patch rather than an edit of the patch it\n     follows\n   * The upstream regression tests named in the patch headers are not carried:\n     upstream ships them only as pytest testsuite/*_test.py files and 3.1.3 has\n     no pytest harness",
        "title": "Details"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789466898",
        "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789466898"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/debian10els/advisories/2026/clsa-2026_1789466898.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-09-15T10:09:28Z",
      "generator": {
        "date": "2026-09-15T10:09:28Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CLSA-2026:1789466898",
      "initial_release_date": "2026-09-15T10:09:28Z",
      "revision_history": [
        {
          "date": "2026-09-15T10:09:28Z",
          "number": "1",
          "summary": "Initial version"
        }
      ],
      "status": "final",
      "version": "1"
    },
    "title": "Fix of 7 CVEs"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Debian 10",
                "product": {
                  "name": "Debian 10",
                  "product_id": "Debian-10",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:debian:debian_linux:10:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Debian"
          }
        ],
        "category": "vendor",
        "name": "Software in the Public Interest, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rsync-0:3.1.3-6+tuxcare.els6.amd64",
                "product": {
                  "name": "rsync-0:3.1.3-6+tuxcare.els6.amd64",
                  "product_id": "rsync-0:3.1.3-6+tuxcare.els6.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/rsync@3.1.3-6%2Btuxcare.els6?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rsync-0:3.1.3-6+tuxcare.els5.amd64",
                "product": {
                  "name": "rsync-0:3.1.3-6+tuxcare.els5.amd64",
                  "product_id": "rsync-0:3.1.3-6+tuxcare.els5.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/rsync@3.1.3-6%2Btuxcare.els5?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rsync-0:3.1.3-6+tuxcare.els4.amd64",
                "product": {
                  "name": "rsync-0:3.1.3-6+tuxcare.els4.amd64",
                  "product_id": "rsync-0:3.1.3-6+tuxcare.els4.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/rsync@3.1.3-6%2Btuxcare.els4?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rsync-0:3.1.3-6+tuxcare.els3.amd64",
                "product": {
                  "name": "rsync-0:3.1.3-6+tuxcare.els3.amd64",
                  "product_id": "rsync-0:3.1.3-6+tuxcare.els3.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/rsync@3.1.3-6%2Btuxcare.els3?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rsync-0:3.1.3-6+tuxcare.els2.amd64",
                "product": {
                  "name": "rsync-0:3.1.3-6+tuxcare.els2.amd64",
                  "product_id": "rsync-0:3.1.3-6+tuxcare.els2.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/rsync@3.1.3-6%2Btuxcare.els2?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rsync-0:3.1.3-6+tuxcare.els1.amd64",
                "product": {
                  "name": "rsync-0:3.1.3-6+tuxcare.els1.amd64",
                  "product_id": "rsync-0:3.1.3-6+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/rsync@3.1.3-6%2Btuxcare.els1?arch=amd64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rsync-0:3.1.3-6+tuxcare.els6.armel",
                "product": {
                  "name": "rsync-0:3.1.3-6+tuxcare.els6.armel",
                  "product_id": "rsync-0:3.1.3-6+tuxcare.els6.armel",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/rsync@3.1.3-6%2Btuxcare.els6?arch=armel"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "armel"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rsync-0:3.1.3-6+tuxcare.els6.arm64",
                "product": {
                  "name": "rsync-0:3.1.3-6+tuxcare.els6.arm64",
                  "product_id": "rsync-0:3.1.3-6+tuxcare.els6.arm64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/rsync@3.1.3-6%2Btuxcare.els6?arch=arm64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-0:3.1.3-6+tuxcare.els6.amd64 as a component of Debian 10",
          "product_id": "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.amd64"
        },
        "product_reference": "rsync-0:3.1.3-6+tuxcare.els6.amd64",
        "relates_to_product_reference": "Debian-10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-0:3.1.3-6+tuxcare.els6.armel as a component of Debian 10",
          "product_id": "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.armel"
        },
        "product_reference": "rsync-0:3.1.3-6+tuxcare.els6.armel",
        "relates_to_product_reference": "Debian-10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-0:3.1.3-6+tuxcare.els6.arm64 as a component of Debian 10",
          "product_id": "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.arm64"
        },
        "product_reference": "rsync-0:3.1.3-6+tuxcare.els6.arm64",
        "relates_to_product_reference": "Debian-10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-0:3.1.3-6+tuxcare.els5.amd64 as a component of Debian 10",
          "product_id": "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64"
        },
        "product_reference": "rsync-0:3.1.3-6+tuxcare.els5.amd64",
        "relates_to_product_reference": "Debian-10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-0:3.1.3-6+tuxcare.els4.amd64 as a component of Debian 10",
          "product_id": "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64"
        },
        "product_reference": "rsync-0:3.1.3-6+tuxcare.els4.amd64",
        "relates_to_product_reference": "Debian-10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-0:3.1.3-6+tuxcare.els3.amd64 as a component of Debian 10",
          "product_id": "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64"
        },
        "product_reference": "rsync-0:3.1.3-6+tuxcare.els3.amd64",
        "relates_to_product_reference": "Debian-10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-0:3.1.3-6+tuxcare.els2.amd64 as a component of Debian 10",
          "product_id": "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64"
        },
        "product_reference": "rsync-0:3.1.3-6+tuxcare.els2.amd64",
        "relates_to_product_reference": "Debian-10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-0:3.1.3-6+tuxcare.els1.amd64 as a component of Debian 10",
          "product_id": "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64"
        },
        "product_reference": "rsync-0:3.1.3-6+tuxcare.els1.amd64",
        "relates_to_product_reference": "Debian-10"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-53784",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access ('Link Following')"
      },
      "notes": [
        {
          "category": "description",
          "text": "rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.arm64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.armel"
        ],
        "known_affected": [
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53784"
        },
        {
          "category": "external",
          "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
          "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-ffg2-fr5g-3rxw",
          "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-ffg2-fr5g-3rxw"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/rsync-path-traversal-via-symlink-module-root",
          "url": "https://www.vulncheck.com/advisories/rsync-path-traversal-via-symlink-module-root"
        }
      ],
      "release_date": "2026-08-13T15:19:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:08:20.256932Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789466898",
          "product_ids": [
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.arm64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.armel"
          ],
          "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789466898"
        },
        {
          "category": "none_available",
          "date": "2026-08-13T15:19:00Z",
          "details": "Affected",
          "product_ids": [
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ]
    },
    {
      "cve": "CVE-2026-53803",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access ('Link Following')"
      },
      "notes": [
        {
          "category": "description",
          "text": "rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject symlinks during ancillary file writes to redirect output to arbitrary filesystem locations, achieving local privilege escalation on installations where rsync runs with elevated privileges such as setuid or privileged daemon configurations.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.arm64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.armel"
        ],
        "known_affected": [
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53803"
        },
        {
          "category": "external",
          "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
          "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-g9f4-7q66-9582",
          "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-g9f4-7q66-9582"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/rsync-symlink-following-arbitrary-file-overwrite",
          "url": "https://www.vulncheck.com/advisories/rsync-symlink-following-arbitrary-file-overwrite"
        }
      ],
      "release_date": "2026-08-13T15:19:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:08:20.256932Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789466898",
          "product_ids": [
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.arm64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.armel"
          ],
          "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789466898"
        },
        {
          "category": "none_available",
          "date": "2026-08-13T15:19:00Z",
          "details": "Affected",
          "product_ids": [
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ]
    },
    {
      "cve": "CVE-2026-53797",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access ('Link Following')"
      },
      "notes": [
        {
          "category": "description",
          "text": "rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically replace a parent directory component with a symlink pointing outside the source root between path resolution and file open operations to disclose file contents outside the intended transfer root.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.arm64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.armel"
        ],
        "known_affected": [
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53797"
        },
        {
          "category": "external",
          "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
          "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-3jj3-qvc7-jp6x",
          "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-3jj3-qvc7-jp6x"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/rsync-symlink-race-condition-information-disclosure",
          "url": "https://www.vulncheck.com/advisories/rsync-symlink-race-condition-information-disclosure"
        }
      ],
      "release_date": "2026-08-13T15:19:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:08:20.256932Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789466898",
          "product_ids": [
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.arm64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.armel"
          ],
          "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789466898"
        },
        {
          "category": "none_available",
          "date": "2026-08-13T15:19:00Z",
          "details": "Affected",
          "product_ids": [
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ]
    },
    {
      "cve": "CVE-2026-53795",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access ('Link Following')"
      },
      "notes": [
        {
          "category": "description",
          "text": "rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.arm64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.armel"
        ],
        "known_affected": [
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53795"
        },
        {
          "category": "external",
          "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
          "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-m9vj-637x-v6pq",
          "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-m9vj-637x-v6pq"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-write-via-temp-dir-link-dest",
          "url": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-write-via-temp-dir-link-dest"
        }
      ],
      "release_date": "2026-08-13T15:19:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:08:20.256932Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789466898",
          "product_ids": [
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.arm64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.armel"
          ],
          "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789466898"
        },
        {
          "category": "none_available",
          "date": "2026-08-13T15:19:00Z",
          "details": "Affected",
          "product_ids": [
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ]
    },
    {
      "cve": "CVE-2026-53796",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access ('Link Following')"
      },
      "notes": [
        {
          "category": "description",
          "text": "rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver's destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes to unintended locations. Attackers can substitute a symlink for a component of the destination path between the path resolution and chdir() call, causing the receiver's working directory to be established outside the intended destination tree so that subsequent relative-path file writes land in unintended filesystem locations.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.arm64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.armel"
        ],
        "known_affected": [
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53796"
        },
        {
          "category": "external",
          "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
          "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-w75h-ccff-w53m",
          "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-w75h-ccff-w53m"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/rsync-toctou-race-condition-via-destination-directory-handling",
          "url": "https://www.vulncheck.com/advisories/rsync-toctou-race-condition-via-destination-directory-handling"
        }
      ],
      "release_date": "2026-08-13T15:19:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:08:20.256932Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789466898",
          "product_ids": [
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.arm64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.armel"
          ],
          "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789466898"
        },
        {
          "category": "none_available",
          "date": "2026-08-13T15:19:00Z",
          "details": "Affected",
          "product_ids": [
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ]
    },
    {
      "cve": "CVE-2026-53793",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access ('Link Following')"
      },
      "notes": [
        {
          "category": "description",
          "text": "rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper handling of the /./ notation or forge delta-basis transfers referencing xname paths that cross the /./ boundary to gain unauthorized read or write access to files outside the module's subtree.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.arm64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.armel"
        ],
        "known_affected": [
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53793"
        },
        {
          "category": "external",
          "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
          "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-wj7w-vh23-mm44",
          "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-wj7w-vh23-mm44"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/rsync-path-confinement-bypass-via-boundary-marker-in-chroot-mode",
          "url": "https://www.vulncheck.com/advisories/rsync-path-confinement-bypass-via-boundary-marker-in-chroot-mode"
        }
      ],
      "release_date": "2026-08-13T15:19:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:08:20.256932Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789466898",
          "product_ids": [
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.arm64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.armel"
          ],
          "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789466898"
        },
        {
          "category": "none_available",
          "date": "2026-08-13T15:19:00Z",
          "details": "Affected",
          "product_ids": [
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ]
    },
    {
      "cve": "CVE-2026-53802",
      "cwe": {
        "id": "CWE-61",
        "name": "UNIX Symbolic Link (Symlink) Following"
      },
      "notes": [
        {
          "category": "description",
          "text": "rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon module root, to read arbitrary files accessible to the rsync process.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.arm64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.armel"
        ],
        "known_affected": [
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64",
          "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53802"
        },
        {
          "category": "external",
          "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
          "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-4mfr-8jrv-49x4",
          "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-4mfr-8jrv-49x4"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-read-via-symlink-following",
          "url": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-read-via-symlink-following"
        }
      ],
      "release_date": "2026-08-13T15:19:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:08:20.256932Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789466898",
          "product_ids": [
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.arm64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els6.armel"
          ],
          "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789466898"
        },
        {
          "category": "none_available",
          "date": "2026-08-13T15:19:00Z",
          "details": "Affected",
          "product_ids": [
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els1.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els2.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els3.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els4.amd64",
            "Debian-10:rsync-0:3.1.3-6+tuxcare.els5.amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ]
    }
  ]
}