* SECURITY UPDATE: remote arbitrary file write via an unrequested file list - debian/patches/CVE-2022-29154.patch: add the receiver-side admission check (and the argument-escaping rework it needs) so a malicious server cannot write files the client never asked for; taken from Red Hat's rsync-3.2.3 patch pair - the same patch adds upstream's two follow-ups to that rework: 1aef79e1, which stops safe_arg() leaving a trailing backslash unescaped for the remote shell, and 4ad3dbcf, which un-escapes daemon option args since no remote shell does it for a daemon - CVE-2022-29154 * SECURITY UPDATE: rrsync restricted-directory escape - debian/patches/CVE-2026-53783.patch: replace the Perl rrsync with upstream's hardened Python implementation, which inode-pins the validated path, denies --copy-unsafe-links, refuses a symlinked --log-file and passes --drop-D; add the --drop-D option it requires. The shebang is normalised to /usr/bin/python3, keeping the convention debian/patches/perl_shebang.patch sets for the shipped scripts - CVE-2026-53783 * SECURITY UPDATE: command and argument injection via unquoted values - debian/patches/CVE-2026-53790.patch: quote or refuse shell-active values in the RSYNC_CONNECT_PROG host substitution, the daemon exec-hook expansions, rsync-ssl hostspecs and remote-shell arguments - CVE-2026-53790 * SECURITY UPDATE: chroot /./ inner-module escape - debian/patches/CVE-2026-53793.patch: engage the secure resolver for the generator basis stat, the module chdir and the receiver write path, and sanitize the peer-supplied basis name on the client too - CVE-2026-53793 * SECURITY UPDATE: arbitrary file read via symlinked input files - debian/patches/CVE-2026-53802.patch: resolve --filter merge files, --files-from/--include-from/--exclude-from, the daemon secrets file and --password-file through a trusted-owner path walk - CVE-2026-53802 * SECURITY UPDATE: arbitrary file write via symlinked output paths - debian/patches/CVE-2026-53803.patch: same path walk for --log-file, --write-batch/--read-batch and the daemon motd, lock, early-input and --config opens, plus an S_ISREG check on --read-batch - CVE-2026-53803 * SECURITY UPDATE: unauthenticated TLS in rsync-ssl - debian/patches/CVE-2026-70454.patch: validate the helper hostname, require certificate verification and bind the certificate to the requested hostname in stunnel mode, and refuse the GnuTLS backend without a CA certificate; each of the three is opt-out through an environment variable, for deployments that cannot meet it -- see the patch header - CVE-2026-70454 * SECURITY UPDATE: unbounded pre-transfer daemon handshake - debian/patches/CVE-2026-70464.patch: bound the greeting, authentication and argument reads with an absolute deadline so an unauthenticated peer cannot hold a max-connections slot open, and cap the argument count - CVE-2026-70464 * debian/control: suggest python3-braceexpand, which the Python rrsync uses for brace expansion when present * debian/rsync.NEWS: document the rrsync interpreter change for anyone using the script in an authorized_keys forced command