{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2026-53783: harden the support/rrsync wrapper: refuse paths that\n resolve outside the restricted directory, refuse -L/-k/-K and\n --copy-unsafe-links there, hand the transfer arguments and the receiver's\n directory options to rsync as held directories, stop path arguments being\n parsed as options, open rrsync.log without following a symlink; add\n --drop-D so a restricted receiver does not create devices or special\n files, and --confine-root so rsync refuses names that leave the restricted\n directory, including --files-from lines and merge files\n- CVE-2026-53802: open the daemon secrets file, the client --password-file,\n --files-from and the --filter merge / per-directory merge files refusing\n attacker-planted symlinks -- confined beneath the module root on a daemon,\n owner-trust walk otherwise; secrets and password files are checked with\n fstat() of the opened fd; /dev/fd, /dev/stdin and <(...) keep working", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792767553", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792767553" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/centos6els/advisories/2026/clsa-2026_1792767553.json" } ], "tracking": { "current_release_date": "2026-10-26T14:34:09Z", "generator": { "date": "2026-10-26T14:34:09Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1792767553", "initial_release_date": "2026-10-23T14:59:15Z", "revision_history": [ { "date": "2026-10-23T14:59:15Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-26T14:34:09Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "rsync: Fix of 2 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 6", "product": { "name": "Community Enterprise Operating System 6", "product_id": "CentOS-6", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:6:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Red Hat, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els14.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els14.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els14.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els14?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els13.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els13.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els13.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els13?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els12.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els12.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els12.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els12?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els11.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els11.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els11.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els11?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els10.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els10.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els10?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els9.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els9.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els9?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els8.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els8.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els8?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els7.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els7.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els7?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els6.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els6.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els6?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els5.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els5.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els5.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els5?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els4.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els4.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els4.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els4?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els3.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els3.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els3?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els2.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els2.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els1.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els1.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els14.i686", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els14.i686", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els14.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els14?arch=i686" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els13.i686", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els13.i686", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els13.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els13?arch=i686" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els12.i686", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els12.i686", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els12.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els12?arch=i686" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els11.i686", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els11.i686", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els11.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els11?arch=i686" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els10.i686", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els10.i686", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els10.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els10?arch=i686" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els14.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els14.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els14.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els14.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els14.i686" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els14.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els13.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els13.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els13.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.i686" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els13.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els12.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.i686" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els12.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els12.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els12.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els11.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els11.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els11.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.i686" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els11.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els10.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els10.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els10.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.i686" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els10.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els9.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els9.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els9.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els8.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els8.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els8.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els7.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els7.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els7.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els6.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els6.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els6.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els5.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els5.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els5.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els4.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els4.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els4.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els3.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els3.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els3.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els2.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els2.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els2.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els1.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-6" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-53783", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')" }, "notes": [ { "category": "description", "text": "rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els14.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els14.x86_64" ], "known_affected": [ "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els1.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els2.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els3.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els4.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els5.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els6.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els7.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els8.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53783" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-9cgc-64g4-3gv5", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-9cgc-64g4-3gv5" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-toctou-race-condition-directory-escape-via-rrsync", "url": "https://www.vulncheck.com/advisories/rsync-toctou-race-condition-directory-escape-via-rrsync" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-23T14:59:15.133929Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792767553", "product_ids": [ "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els14.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els14.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792767553" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els1.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els2.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els3.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els4.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els5.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els6.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els7.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els8.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53802", "cwe": { "id": "CWE-61", "name": "UNIX Symbolic Link (Symlink) Following" }, "notes": [ { "category": "description", "text": "rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon module root, to read arbitrary files accessible to the rsync process.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els14.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els14.x86_64" ], "known_affected": [ "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els1.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els2.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els3.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els4.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els5.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els6.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els7.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els8.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53802" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-4mfr-8jrv-49x4", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-4mfr-8jrv-49x4" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-read-via-symlink-following", "url": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-read-via-symlink-following" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-23T14:59:15.133929Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792767553", "product_ids": [ "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els14.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els14.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792767553" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els1.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els2.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els3.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els4.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els5.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els6.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els7.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els8.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }