{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "* SECURITY UPDATE: remote arbitrary file write via an unrequested file list\n - debian/patches/CVE-2022-29154.patch: add the receiver-side admission\n check (and the argument-escaping rework it needs) so a malicious server\n cannot write files the client never asked for; taken from Red Hat's\n rsync-3.2.3 patch pair\n - the same patch adds upstream's two follow-ups to that rework: 1aef79e1,\n which stops safe_arg() leaving a trailing backslash unescaped for the\n remote shell, and 4ad3dbcf, which un-escapes daemon option args since no\n remote shell does it for a daemon\n - CVE-2022-29154\n * SECURITY UPDATE: rrsync restricted-directory escape\n - debian/patches/CVE-2026-53783.patch: replace the Perl rrsync with\n upstream's hardened Python implementation, which inode-pins the\n validated path, denies --copy-unsafe-links, refuses a symlinked\n --log-file and passes --drop-D; add the --drop-D option it requires.\n The shebang is normalised to /usr/bin/python3, keeping the convention\n debian/patches/perl_shebang.patch sets for the shipped scripts\n - CVE-2026-53783\n * SECURITY UPDATE: command and argument injection via unquoted values\n - debian/patches/CVE-2026-53790.patch: quote or refuse shell-active\n values in the RSYNC_CONNECT_PROG host substitution, the daemon\n exec-hook expansions, rsync-ssl hostspecs and remote-shell arguments\n - CVE-2026-53790\n * SECURITY UPDATE: chroot /./ inner-module escape\n - debian/patches/CVE-2026-53793.patch: engage the secure resolver for the\n generator basis stat, the module chdir and the receiver write path, and\n sanitize the peer-supplied basis name on the client too\n - CVE-2026-53793\n * SECURITY UPDATE: arbitrary file read via symlinked input files\n - debian/patches/CVE-2026-53802.patch: resolve --filter merge files,\n --files-from/--include-from/--exclude-from, the daemon secrets file and\n --password-file through a trusted-owner path walk\n - CVE-2026-53802\n * SECURITY UPDATE: arbitrary file write via symlinked output paths\n - debian/patches/CVE-2026-53803.patch: same path walk for --log-file,\n --write-batch/--read-batch and the daemon motd, lock, early-input and\n --config opens, plus an S_ISREG check on --read-batch\n - CVE-2026-53803\n * SECURITY UPDATE: unauthenticated TLS in rsync-ssl\n - debian/patches/CVE-2026-70454.patch: validate the helper hostname,\n require certificate verification and bind the certificate to the\n requested hostname in stunnel mode, and refuse the GnuTLS backend\n without a CA certificate; each of the three is opt-out through an\n environment variable, for deployments that cannot meet it -- see the\n patch header\n - CVE-2026-70454\n * SECURITY UPDATE: unbounded pre-transfer daemon handshake\n - debian/patches/CVE-2026-70464.patch: bound the greeting, authentication\n and argument reads with an absolute deadline so an unauthenticated peer\n cannot hold a max-connections slot open, and cap the argument count\n - CVE-2026-70464\n * debian/control: suggest python3-braceexpand, which the Python rrsync uses\n for brace expansion when present\n * debian/rsync.NEWS: document the rrsync interpreter change for anyone using\n the script in an authorized_keys forced command", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789635862", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789635862" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/debian11els/advisories/2026/clsa-2026_1789635862.json" } ], "tracking": { "current_release_date": "2026-09-17T09:05:32Z", "generator": { "date": "2026-09-17T09:05:32Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1789635862", "initial_release_date": "2026-09-17T09:05:32Z", "revision_history": [ { "date": "2026-09-17T09:05:32Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "Fix of 8 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian 11", "product": { "name": "Debian 11", "product_id": "Debian-11", "product_identification_helper": { "cpe": "cpe:2.3:o:debian:debian_linux:11:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Debian" } ], "category": "vendor", "name": "Software in the Public Interest, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel", "product": { "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel", "product_id": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel", "product_identification_helper": { "purl": "pkg:deb/tuxcare/rsync@3.2.3-4%2Bdeb11u4%2Btuxcare.els3?arch=armel" } } } ], "category": "architecture", "name": "armel" }, { "branches": [ { "category": "product_version", "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "product": { "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "product_id": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/rsync@3.2.3-4%2Bdeb11u4%2Btuxcare.els3?arch=amd64" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "product": { "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "product_id": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/rsync@3.2.3-4%2Bdeb11u4%2Btuxcare.els3?arch=arm64" } } } ], "category": "architecture", "name": "arm64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel as a component of Debian 11", "product_id": "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" }, "product_reference": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64 as a component of Debian 11", "product_id": "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64" }, "product_reference": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64 as a component of Debian 11", "product_id": "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64" }, "product_reference": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "relates_to_product_reference": "Debian-11" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-53803", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')" }, "notes": [ { "category": "description", "text": "rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject symlinks during ancillary file writes to redirect output to arbitrary filesystem locations, achieving local privilege escalation on installations where rsync runs with elevated privileges such as setuid or privileged daemon configurations.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53803" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-g9f4-7q66-9582", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-g9f4-7q66-9582" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-symlink-following-arbitrary-file-overwrite", "url": "https://www.vulncheck.com/advisories/rsync-symlink-following-arbitrary-file-overwrite" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T09:04:24.545972Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789635862", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789635862" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53783", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')" }, "notes": [ { "category": "description", "text": "rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53783" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-9cgc-64g4-3gv5", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-9cgc-64g4-3gv5" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-toctou-race-condition-directory-escape-via-rrsync", "url": "https://www.vulncheck.com/advisories/rsync-toctou-race-condition-directory-escape-via-rrsync" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T09:04:24.545972Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789635862", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789635862" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53790", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "description", "text": "rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53790" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-5hcf-7xxm-rmqq", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-5hcf-7xxm-rmqq" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-command-injection-via-multiple-code-paths", "url": "https://www.vulncheck.com/advisories/rsync-command-injection-via-multiple-code-paths" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T09:04:24.545972Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789635862", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789635862" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-29154", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "description", "text": "An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-29154" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/08/02/1", "url": "http://www.openwall.com/lists/oss-security/2022/08/02/1" }, { "category": "external", "summary": "https://github.com/WayneD/rsync/tags", "url": "https://github.com/WayneD/rsync/tags" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMBOJ77A7T7PQCARMDUK75TE6LLESZ3O/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMBOJ77A7T7PQCARMDUK75TE6LLESZ3O/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRQAI7H4M4RQZ2IWZUEEXECBE5D56BH2/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRQAI7H4M4RQZ2IWZUEEXECBE5D56BH2/" } ], "release_date": "2022-08-02T15:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T09:04:24.545972Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789635862", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789635862" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53793", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')" }, "notes": [ { "category": "description", "text": "rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper handling of the /./ notation or forge delta-basis transfers referencing xname paths that cross the /./ boundary to gain unauthorized read or write access to files outside the module's subtree.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53793" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-wj7w-vh23-mm44", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-wj7w-vh23-mm44" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-path-confinement-bypass-via-boundary-marker-in-chroot-mode", "url": "https://www.vulncheck.com/advisories/rsync-path-confinement-bypass-via-boundary-marker-in-chroot-mode" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T09:04:24.545972Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789635862", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789635862" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53802", "cwe": { "id": "CWE-61", "name": "UNIX Symbolic Link (Symlink) Following" }, "notes": [ { "category": "description", "text": "rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon module root, to read arbitrary files accessible to the rsync process.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53802" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-4mfr-8jrv-49x4", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-4mfr-8jrv-49x4" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-read-via-symlink-following", "url": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-read-via-symlink-following" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T09:04:24.545972Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789635862", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789635862" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-70454", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "notes": [ { "category": "description", "text": "rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to validate server TLS certificates against a trusted CA or verify certificate hostname matching to decrypt or tamper with rsync session content without detection by the client.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-70454" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-3c3x-ww2w-5r5p", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-3c3x-ww2w-5r5p" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-tls-certificate-validation-bypass-via-ssl-openssl-mode", "url": "https://www.vulncheck.com/advisories/rsync-tls-certificate-validation-bypass-via-ssl-openssl-mode" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T09:04:24.545972Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789635862", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789635862" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-70464", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "description", "text": "rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to legitimate clients.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-70464" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-hrwq-ccf7-rw5m", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-hrwq-ccf7-rw5m" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-connection-slot-exhaustion-dos-via-handshake-stall", "url": "https://www.vulncheck.com/advisories/rsync-connection-slot-exhaustion-dos-via-handshake-stall" } ], "release_date": "2026-08-13T15:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T09:04:24.545972Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789635862", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789635862" } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }