Release date:
2026-09-03 11:10:03 UTC
Description:
- CVE-2026-53789: force implied-parent directories to non-content on the
receiver so a malicious sender cannot widen --delete scope
- CVE-2026-70459: reject a non-directory transfer-root entry so a forged
"." cannot drive a --force recursive delete of the destination
- CVE-2026-70457: clamp the snprintf() length before the err_buf[len]
writes in parse_size_arg() to stop an out-of-bounds .bss write
Updated packages:
-
rsync-3.2.3-19.el9_2.tuxcare.els12.x86_64.rpm
sha:7cbb9bb8e1fcd4cb47a25bfb23728c8ac9db3cc88f48938a62cf3f9426b5dfe7
-
rsync-daemon-3.2.3-19.el9_2.tuxcare.els12.noarch.rpm
sha:00fcb3f9414e7d97669b848fe59232e336e021bf10370ce1d7ab1fdada2bdbff
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
