Release date:
2026-09-07 09:30:28 UTC
Description:
- CVE-2026-70463: auth users authorization bypass because auth_server()
tokenised the user list on whitespace as well as commas, discarding an
@Group Name deny rule
- CVE-2026-53786: daemon filter-merge bypass of the module filter list
because parse_filter_file() checked the module-prefixed path
- CVE-2026-70459: daemon NULL dereference when the first file-list entry
is a dot entry that is not typed as a directory
- CVE-2026-53789: --delete scope widening via implied-parent, synthetic
transfer-root and legacy protocol<30 directory reclassification
Updated packages:
-
rsync-3.1.3-12.el8_4.tuxcare.els12.x86_64.rpm
sha:e3d27ddc48eb3fb78b4854f018922405590b77a23eb3bdac093c64cbd1de52ba
-
rsync-daemon-3.1.3-12.el8_4.tuxcare.els12.noarch.rpm
sha:e71f61d4dfa44766209bd995a6a2b0f5b5c835fee07a7fcfb43467bd608fc84a
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
