{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "* SECURITY UPDATE: CPU exhaustion from a crafted chain of equal weak checksums\n - debian/patches/CVE-2026-70453.patch: bound the number of same-weak-checksum\n candidates hash_search() examines per file offset, so a degenerate chain\n cannot turn the inner loop into an O(file_size * chain_length) scan\n - CVE-2026-70453\n * SECURITY UPDATE: heap out-of-bounds write in read_args()\n - debian/patches/CVE-2026-70456.patch: reserve room for the trailing NULL\n before storing it, so a peer argument count landing exactly on the argv\n allocation cannot write one pointer past the end\n - CVE-2026-70456\n * SECURITY UPDATE: peer-supplied MSG_IO_TIMEOUT defeats the client's timeout\n - debian/patches/CVE-2026-70462.patch: reject a non-positive value, cap the\n peer's value at 24 hours, and make set_io_timeout() arithmetic\n overflow-safe so a large value cannot wrap allowed_lull negative\n - CVE-2026-70462\n * SECURITY UPDATE: authorization bypass in the \"auth users\" parser\n - debian/patches/CVE-2026-70463.patch: parse with conf_strtok so a leading\n comma splits on commas alone, and a deny or :ro rule naming a group whose\n name contains a space fires as written\n - CVE-2026-70463\n * SECURITY UPDATE: wild-pointer read in the per-connection daemon child\n - debian/patches/CVE-2026-70459.patch: reject a non-directory transfer-root\n entry, and require dir_flist to hold an entry before trusting parent_ndx 0\n - CVE-2026-70459\n * SECURITY UPDATE: out-of-bounds write from a peer-set FLAG_HLINKED\n - debian/patches/CVE-2026-70458.patch: gate FLAG_HLINKED on\n preserve_hard_links and exclude directories, so a peer cannot set it while\n -H is off and have HLINK_BUMP() displace F_SUM() past the extras\n - the same patch carries upstream aed77143, which closes a separate\n unassigned out-of-bounds read of that field: start_server() now sets\n sender_keeps_checksum for a daemon sender using -c with a %C log format,\n and hard_link_check() requires S_ISREG before the basis compare\n - CVE-2026-70458\n * SECURITY UPDATE: the per-allocation size cap could be switched off\n - debian/patches/CVE-2026-53794.patch: reject --max-alloc=0, which disabled\n the cap that is the defence behind CVE-2024-12084 and was forwarded on the\n wire; the rsync.1 text describing 0 as \"no limit\" is corrected with it\n - a value of 0 is now an error rather than \"no limit\"; see debian/rsync.NEWS\n - CVE-2026-53794\n * SECURITY UPDATE: implied-parent creation escapes the destination tree\n - debian/patches/CVE-2026-53785.patch: create each component of make_path()\n through the held-directory-fd primitive, so a planted parent symlink under\n --relative cannot place the new directories outside the tree\n - CVE-2026-53785\n * SECURITY UPDATE: source address spoofing via the PROXY protocol header\n - debian/patches/CVE-2026-53791.patch: add the \"proxy protocol hosts\" global\n and honour a forwarded address only when the direct socket peer matches it,\n so a client connecting directly cannot forge its address past hosts allow\n - \"proxy protocol = true\" with no \"proxy protocol hosts\" now refuses every\n connection and warns at startup, which is upstream's fail-closed default;\n see debian/rsync.NEWS\n - CVE-2026-53791\n * SECURITY UPDATE: client-supplied --filter merge file bypasses the module filter\n - debian/patches/CVE-2026-53786.patch: strip the module-dir prefix, when it is\n actually present, before checking the merge file against the daemon filter\n list, and treat a filtered file as absent rather than a fatal error\n - CVE-2026-53786\n * SECURITY UPDATE: absolute --temp-dir or --link-dest disables rename confinement\n - debian/patches/CVE-2026-53795.patch: confine each side of do_rename_at() and\n do_link_at() independently, so an absolute path on one side no longer drops\n the other side back to the unconfined call\n - CVE-2026-53795", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/debian11els/advisories/2026/clsa-2026_1789728065.json" } ], "tracking": { "current_release_date": "2026-09-18T12:28:53Z", "generator": { "date": "2026-09-18T12:28:53Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1789728065", "initial_release_date": "2026-09-18T10:43:15Z", "revision_history": [ { "date": "2026-09-18T10:43:15Z", "number": "1", "summary": "Initial version" }, { "date": "2026-09-18T12:28:53Z", "number": "2", "summary": "Update document" } ], "status": "final", "version": "2" }, "title": "Fix of 11 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian 11", "product": { "name": "Debian 11", "product_id": "Debian-11", "product_identification_helper": { "cpe": "cpe:2.3:o:debian:debian_linux:11:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Debian" } ], "category": "vendor", "name": "Software in the Public Interest, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "product": { "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "product_id": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/rsync@3.2.3-4%2Bdeb11u4%2Btuxcare.els4?arch=arm64" } } }, { "category": "product_version", "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "product": { "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "product_id": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/rsync@3.2.3-4%2Bdeb11u4%2Btuxcare.els3?arch=arm64" } } } ], "category": "architecture", "name": "arm64" }, { "branches": [ { "category": "product_version", "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel", "product": { "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel", "product_id": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel", "product_identification_helper": { "purl": "pkg:deb/tuxcare/rsync@3.2.3-4%2Bdeb11u4%2Btuxcare.els4?arch=armel" } } }, { "category": "product_version", "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel", "product": { "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel", "product_id": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel", "product_identification_helper": { "purl": "pkg:deb/tuxcare/rsync@3.2.3-4%2Bdeb11u4%2Btuxcare.els3?arch=armel" } } } ], "category": "architecture", "name": "armel" }, { "branches": [ { "category": "product_version", "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "product": { "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "product_id": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/rsync@3.2.3-4%2Bdeb11u4%2Btuxcare.els4?arch=amd64" } } }, { "category": "product_version", "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "product": { "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "product_id": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/rsync@3.2.3-4%2Bdeb11u4%2Btuxcare.els3?arch=amd64" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64 as a component of Debian 11", "product_id": "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64" }, "product_reference": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel as a component of Debian 11", "product_id": "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" }, "product_reference": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64 as a component of Debian 11", "product_id": "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64" }, "product_reference": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel as a component of Debian 11", "product_id": "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" }, "product_reference": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64 as a component of Debian 11", "product_id": "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64" }, "product_reference": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64 as a component of Debian 11", "product_id": "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64" }, "product_reference": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "relates_to_product_reference": "Debian-11" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-53791", "cwe": { "id": "CWE-290", "name": "Authentication Bypass by Spoofing" }, "notes": [ { "category": "description", "text": "rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" ], "known_affected": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53791" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-h2q9-5fr8-w635", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-h2q9-5fr8-w635" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-daemon-ip-spoofing-via-proxy-protocol-header", "url": "https://www.vulncheck.com/advisories/rsync-daemon-ip-spoofing-via-proxy-protocol-header" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-18T10:41:08.535040Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53784", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')" }, "notes": [ { "category": "description", "text": "rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" ], "known_affected": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53784" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-ffg2-fr5g-3rxw", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-ffg2-fr5g-3rxw" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-path-traversal-via-symlink-module-root", "url": "https://www.vulncheck.com/advisories/rsync-path-traversal-via-symlink-module-root" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-18T10:41:08.535040Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-70463", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "description", "text": "rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the group name causes the parser to split the entry at the space boundary, discarding the deny rule associated with the group. An authenticated user whose username or group membership would be denied by an @Group Name auth users entry can connect to a restricted module because the deny rule is silently discarded during parsing.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" ], "known_affected": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-70463" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-pfj8-79vq-xgvr", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-pfj8-79vq-xgvr" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-authorization-bypass-via-auth-users-directive-parsing", "url": "https://www.vulncheck.com/advisories/rsync-authorization-bypass-via-auth-users-directive-parsing" } ], "release_date": "2026-08-13T15:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-18T10:41:08.535040Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065" }, { "category": "none_available", "date": "2026-08-13T15:20:00Z", "details": "Affected", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-70456", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one slot beyond the allocation boundary, corrupting adjacent heap memory.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" ], "known_affected": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-70456" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-78jc-79jv-v6rw", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-78jc-79jv-v6rw" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-read-args", "url": "https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-read-args" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-18T10:41:08.535040Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53786", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "description", "text": "rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" ], "known_affected": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53786" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-mrc3-6cwx-hch6", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-mrc3-6cwx-hch6" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-filter-rule-bypass-via-filter-merge-directive", "url": "https://www.vulncheck.com/advisories/rsync-filter-rule-bypass-via-filter-merge-directive" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-18T10:41:08.535040Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53785", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')" }, "notes": [ { "category": "description", "text": "rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" ], "known_affected": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53785" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-pph3-7xmf-rrqg", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-pph3-7xmf-rrqg" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-path-traversal-write-escape-via-relative-mode", "url": "https://www.vulncheck.com/advisories/rsync-path-traversal-write-escape-via-relative-mode" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-18T10:41:08.535040Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53794", "cwe": { "id": "CWE-1284", "name": "Improper Validation of Specified Quantity in Input" }, "notes": [ { "category": "description", "text": "rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory allocations for file list and data structures, potentially exhausting available memory and causing a denial of service.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" ], "known_affected": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53794" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-p827-vwcp-m964", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-p827-vwcp-m964" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-denial-of-service-via-max-alloc-0-logic-error", "url": "https://www.vulncheck.com/advisories/rsync-denial-of-service-via-max-alloc-0-logic-error" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-18T10:41:08.535040Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53795", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')" }, "notes": [ { "category": "description", "text": "rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" ], "known_affected": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53795" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-m9vj-637x-v6pq", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-m9vj-637x-v6pq" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-write-via-temp-dir-link-dest", "url": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-write-via-temp-dir-link-dest" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-18T10:41:08.535040Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-70453", "cwe": { "id": "CWE-407", "name": "Inefficient Algorithmic Complexity" }, "notes": [ { "category": "description", "text": "rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU resources with a modest number of crafted entries, causing a sustained denial of service.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" ], "known_affected": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-70453" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-8x5r-mjx8-83hv", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-8x5r-mjx8-83hv" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-algorithmic-complexity-dos-via-hash-search", "url": "https://www.vulncheck.com/advisories/rsync-algorithmic-complexity-dos-via-hash-search" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-18T10:41:08.535040Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-70462", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" ], "known_affected": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-70462" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-j9wh-5jmp-2m64", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-j9wh-5jmp-2m64" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-signed-integer-overflow-via-msg-io-timeout", "url": "https://www.vulncheck.com/advisories/rsync-signed-integer-overflow-via-msg-io-timeout" } ], "release_date": "2026-08-13T15:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-18T10:41:08.535040Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065" }, { "category": "none_available", "date": "2026-08-13T15:20:00Z", "details": "Affected", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-70458", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing F_SUM field in the file_struct layout to access memory past the end of the allocated structure, corrupting adjacent heap or stack data.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" ], "known_affected": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-70458" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-gg3m-4m9m-268h", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-gg3m-4m9m-268h" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-flag-hlinked-handling", "url": "https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-flag-hlinked-handling" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-18T10:41:08.535040Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-70459", "cwe": { "id": "CWE-908", "name": "Use of Uninitialized Resource" }, "notes": [ { "category": "description", "text": "rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a directory structure pointer without verifying the entry type, resulting in an invalid or uninitialized pointer dereference that terminates the client connection.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" ], "known_affected": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-70459" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-p4v4-qxw9-q72m", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-p4v4-qxw9-q72m" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-daemon-crash-via-malformed-file-list-entry", "url": "https://www.vulncheck.com/advisories/rsync-daemon-crash-via-malformed-file-list-entry" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-18T10:41:08.535040Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789728065" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64", "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }