[CLSA-2026:1782739272] Fix CVE(s): CVE-2026-29518, CVE-2026-41035
Type:
security
Severity:
Important
Release date:
2026-06-29 13:21:30 UTC
Description:
* PACKAGING FIX: rsync daemon default group on stock Ubuntu/Debian (ELSR-8050) - the daemon's compile-time NOBODY_GROUP was resolved to "nobody" by the focal build chroot's /etc/group, but stock Ubuntu/Debian have only "nogroup", so daemon modules with no explicit gid were rejected with "@ERROR: invalid gid nobody" (test_daemon / ELSR-8050) - debian/rules: build with rsync's own --with-nobody-group=nogroup configure option so the compile-time NOBODY_GROUP default is baked as "nogroup" regardless of the build chroot, matching the stock Ubuntu/Debian rsync build (fixes modules with no explicit gid) - debian/patches/rsync-daemon-nobody-group-fallback.patch: in the daemon's add_a_group() resolve a "nobody" group to "nogroup" at runtime when the host has no "nobody" group, so a module that explicitly sets "gid = nobody" is also honoured on stock Ubuntu/Debian instead of being rejected with "@ERROR: invalid gid nobody"; any other unresolvable group is still rejected - upstream: configure.ac AC_ARG_WITH(nobody-group) https://github.com/RsyncProject/rsync/blob/v3.1.3/configure.ac#L142-L157 Debian bugs #144570 (https://bugs.debian.org/144570) and #25299 - ELSR-8050
Updated packages:
  • rsync_3.1.3-8ubuntu0.9+tuxcare.els4_amd64.deb
    sha:f9c04fb8f659de18f0537e44fa507e8cb6e034f5
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.