Release date:
2026-09-04 14:12:40 UTC
Description:
* SECURITY UPDATE: arbitrary file deletion via malicious file list
- debian/patches/CVE-2026-53789.patch: keep synthetic and legacy implied
parent directories non-content in exclude.c, flist.c so a malicious
sender cannot forge the transfer-root entry as a content directory and
expand a scoped --delete beyond the requested path; additionally reject
a non-directory transfer-root entry in flist.c so a forged "." file
entry cannot be used with --force to recursively wipe the destination
- CVE-2026-53789
Updated packages:
-
rsync_3.1.3-8ubuntu0.9+tuxcare.els5_amd64.deb
sha:75eb7d07cb08ddbd0c1193e7d2ce92084fa988f1
-
rsync_3.1.3-8ubuntu0.9+tuxcare.els5_arm64.deb
sha:fa6c888d94547f4eb26deecea3f7f7cc1ed24528
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
