{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2026-53801: prevent the sender from listing a directory outside the\n transfer through a path component swapped for a symlink\n- CVE-2026-53797: prevent the sender from reading a file outside the\n transfer the same way\n- CVE-2026-53800: prevent --remove-source-files from deleting a file\n outside the transfer the same way", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791971338", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791971338" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/centos6els/advisories/2026/clsa-2026_1791971338.json" } ], "tracking": { "current_release_date": "2026-10-18T19:34:55Z", "generator": { "date": "2026-10-18T19:34:55Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1791971338", "initial_release_date": "2026-10-14T09:48:59Z", "revision_history": [ { "date": "2026-10-14T09:48:59Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-18T19:34:55Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "rsync: Fix of 4 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 6", "product": { "name": "Community Enterprise Operating System 6", "product_id": "CentOS-6", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:6:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Red Hat, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els13.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els13.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els13.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els13?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els12.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els12.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els12.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els12?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els11.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els11.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els11.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els11?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els10.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els10.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els10?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els9.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els9.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els9?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els8.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els8.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els8?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els7.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els7.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els7?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els6.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els6.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els6?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els5.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els5.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els5.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els5?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els4.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els4.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els4.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els4?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els3.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els3.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els3?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els2.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els2.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els1.x86_64", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els1.x86_64", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els13.i686", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els13.i686", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els13.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els13?arch=i686" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els12.i686", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els12.i686", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els12.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els12?arch=i686" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els11.i686", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els11.i686", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els11.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els11?arch=i686" } } }, { "category": "product_version", "name": "rsync-0:3.0.6-12.el6.tuxcare.els10.i686", "product": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els10.i686", "product_id": "rsync-0:3.0.6-12.el6.tuxcare.els10.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rsync@3.0.6-12.el6.tuxcare.els10?arch=i686" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els13.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els13.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els13.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.i686" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els13.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els12.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.i686" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els12.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els12.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els12.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els11.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els11.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els11.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.i686" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els11.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els10.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els10.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els10.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.i686" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els10.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els9.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els9.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els9.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els8.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els8.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els8.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els7.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els7.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els7.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els6.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els6.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els6.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els5.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els5.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els5.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els4.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els4.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els4.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els3.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els3.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els3.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els2.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els2.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els2.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "rsync-0:3.0.6-12.el6.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els1.x86_64" }, "product_reference": "rsync-0:3.0.6-12.el6.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-6" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-53797", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')" }, "notes": [ { "category": "description", "text": "rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically replace a parent directory component with a symlink pointing outside the source root between path resolution and file open operations to disclose file contents outside the intended transfer root.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.x86_64" ], "known_affected": [ "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els1.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els2.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els3.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els4.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els5.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els6.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els7.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els8.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53797" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-3jj3-qvc7-jp6x", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-3jj3-qvc7-jp6x" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-symlink-race-condition-information-disclosure", "url": "https://www.vulncheck.com/advisories/rsync-symlink-race-condition-information-disclosure" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-14T09:48:59.882017Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791971338", "product_ids": [ "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791971338" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els1.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els2.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els3.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els4.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els5.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els6.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els7.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els8.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53795", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')" }, "notes": [ { "category": "description", "text": "rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.x86_64" ], "known_affected": [ "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els1.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els2.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els3.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els4.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els5.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els6.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els7.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els8.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53795" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-m9vj-637x-v6pq", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-m9vj-637x-v6pq" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-write-via-temp-dir-link-dest", "url": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-write-via-temp-dir-link-dest" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-14T09:48:59.882017Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791971338", "product_ids": [ "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791971338" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els1.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els2.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els3.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els4.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els5.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els6.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els7.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els8.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53800", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')" }, "notes": [ { "category": "description", "text": "rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink() call, causing rsync to delete the symlink target rather than the intended source file.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.x86_64" ], "known_affected": [ "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els1.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els2.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els3.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els4.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els5.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els6.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els7.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els8.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53800" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-v3vw-pvpg-chwh", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-v3vw-pvpg-chwh" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-symlink-race-condition-via-remove-source-files", "url": "https://www.vulncheck.com/advisories/rsync-symlink-race-condition-via-remove-source-files" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-14T09:48:59.882017Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791971338", "product_ids": [ "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791971338" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els1.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els2.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els3.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els4.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els5.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els6.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els7.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els8.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53801", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')" }, "notes": [ { "category": "description", "text": "rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of the scanned tree can replace a symlink with a directory entry pointing outside the module root between the lstat() call and the subsequent opendir() call, exposing files beyond the intended root in both daemon-mode and non-daemon sender-side scanning.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.x86_64" ], "known_affected": [ "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els1.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els2.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els3.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els4.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els5.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els6.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els7.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els8.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53801" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0" }, { "category": "external", "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-mch3-qr4p-chgm", "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-mch3-qr4p-chgm" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/rsync-symlink-race-condition-directory-traversal", "url": "https://www.vulncheck.com/advisories/rsync-symlink-race-condition-directory-traversal" } ], "release_date": "2026-08-13T15:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-14T09:48:59.882017Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791971338", "product_ids": [ "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els13.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791971338" }, { "category": "none_available", "date": "2026-08-13T15:19:00Z", "details": "Affected", "product_ids": [ "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els1.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els10.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els11.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.i686", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els12.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els2.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els3.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els4.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els5.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els6.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els7.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els8.x86_64", "CentOS-6:rsync-0:3.0.6-12.el6.tuxcare.els9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }