[CLSA-2026:1789662743] Fix of 6 CVEs

Type:

security

Severity:

Important

Release date:

2026-09-17 16:32:38 UTC

Description:

   * SECURITY UPDATE: shell metacharacter injection via daemon config hooks and RSYNC_CONNECT_PROG
     - debian/patches/CVE-2026-53790.patch: backport the upstream fix
     - CVE-2026-53790
   * SECURITY UPDATE: daemon inner-chroot module path escape in the /./ handling
     - debian/patches/CVE-2026-53793.patch: backport the upstream fix
     - CVE-2026-53793
   * SECURITY UPDATE: unbounded hash chain walk in hash_search()
     - debian/patches/CVE-2026-70453.patch: backport the upstream fix
     - CVE-2026-70453
   * SECURITY UPDATE: out-of-bounds F_SUM read in hard_link_check()
     - debian/patches/CVE-2026-70458.patch: backport the upstream fix
     - CVE-2026-70458
   * SECURITY UPDATE: I/O timeout bypass via MSG_IO_TIMEOUT
     - debian/patches/CVE-2026-70462.patch: backport the upstream fix
     - CVE-2026-70462
   * SECURITY UPDATE: unbounded pre-transfer handshake in start_daemon()
     - debian/patches/CVE-2026-70464.patch: backport the upstream fix
     - CVE-2026-70464

CVEs fixed:

Updated packages:

rsync_3.1.1-3ubuntu1.3+tuxcare.els17_amd64.deb
sha:1375e3431f74a2bab1fecab6d70f8d048eb6da28

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.