{"id":"CVE-2026-29518","aliases":["ALPINE-CVE-2026-29518","ALSA-2026:26332","ALSA-2026:26408","ALSA-2026:26410","AZL-87012","BELL-CVE-2026-29518","CLSA-2026-1779694338","CLSA-2026-1779694460","CLSA-2026-1779694727","CLSA-2026-1779694887","CLSA-2026-1779746464","CLSA-2026-1779746676","CLSA-2026-1779747925","CLSA-2026-1779822401","CLSA-2026-1779823985","CLSA-2026-1779824462","CLSA-2026-1779869103","CLSA-2026-1780480701","CLSA-2026-1780513862","CLSA-2026-1782739272","CLSA-2026-1788335736","CLSA-2026-1789745909","CLSA-2026-1791331076","CLSA-2026-1791331932","CLSA-2026-1791907584","CLSA-2026-1791908277","DEBIAN-CVE-2026-29518","EUVD-2026-31100","GHSA-pfv9-gp3h-73xv","JLSEC-2026-626","MGASA-2026-0265","OESA-2026-4752","OESA-2026-4753","OESA-2026-4754","RHSA-2026:26332","RHSA-2026:26408","RHSA-2026:26410","RLSA-2026:26332","RLSA-2026:26408","RLSA-2026:26410","SUSE-SU-2026:2038-1","SUSE-SU-2026:2048-1","SUSE-SU-2026:2083-1","SUSE-SU-2026:21726-1","SUSE-SU-2026:21739-1","SUSE-SU-2026:21980-1","SUSE-SU-2026:22015-1","SUSE-SU-2026:3629-1","UBUNTU-CVE-2026-29518","openSUSE-SU-2026:10857-1","openSUSE-SU-2026:20877-1"],"status":"published","title":"Rsync \u003c 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write","description":"Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.","severity":{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00152,"percentile":0.0438,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-367"],"published":"2026-05-20T00:00:00Z","modified":"2026-11-11T12:45:11Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"rsync","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"rsync","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"rsync","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"rsync","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"rsync","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"rsync","fixed_in":["3.4.3-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"rsync","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"rsync","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"rsync","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"rsync","fixed_in":["3.1.3-19.el8.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"rsync-daemon","fixed_in":["3.1.3-19.el8.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"rsync","fixed_in":["3.1.1-3ubuntu1.3+tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"rsync","fixed_in":["3.1.2-2.1ubuntu1.6+tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"rsync","fixed_in":["3.1.3-12.el8.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"rsync-daemon","fixed_in":["3.1.3-12.el8.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"rsync","fixed_in":["3.1.2-12.0.1.el7_9.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"rsync","fixed_in":["3.1.2-12.0.1.el7_9.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"rsync","fixed_in":["3.1.2-12.0.1.el7_9.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync","fixed_in":["3.2.5-3.el9_6.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync-daemon","fixed_in":["3.2.5-3.el9_6.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync-rrsync","fixed_in":["3.2.5-3.el9_6.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"rsync","fixed_in":["3.2.3-19.el9_2.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"rsync-daemon","fixed_in":["3.2.3-19.el9_2.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"rsync","fixed_in":["3.1.3-12.el8_4.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"rsync-daemon","fixed_in":["3.1.3-12.el8_4.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"rsync","fixed_in":["3.2.7-1+deb12u5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rsync","fixed_in":["3.4.1+ds1-5+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rsync","fixed_in":["3.4.3+ds1-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"rsync_jll","fixed_in":["3.4.4+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"rsync","fixed_in":["3.1.0-2ubuntu0.4+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rsync","fixed_in":["3.1.1-3ubuntu1.3+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rsync","fixed_in":["3.1.2-2.1ubuntu1.6+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rsync","fixed_in":["3.1.3-8ubuntu0.9+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rsync","fixed_in":["3.2.7-0ubuntu0.22.04.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rsync","fixed_in":["3.2.7-1ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"rsync","fixed_in":["3.4.1+ds1-5ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"rsync","fixed_in":["3.4.1+ds1-7ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-27.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-27.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-7.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-7.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-7.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.7-r0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.1-r0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.5-r0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-19.el8.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-19.el8.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3ubuntu1.3+tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2.1ubuntu1.6+tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-12.0.1.el7_9.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-12.0.1.el7_9.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-12.0.1.el7_9.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-3.el9_6.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-3.el9_6.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-3.el9_6.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-12.el6.tuxcare.els8"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-12.el6.tuxcare.els8"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-6+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-19.el9_2.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-19.el9_2.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8_4.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8_4.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-8ubuntu0.9+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-6+tuxcare.els5"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3ubuntu1.3+tuxcare.els18"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-12.el6.tuxcare.els11"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-12.el6.tuxcare.els11"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-12.el6.tuxcare.els12"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-12.el6.tuxcare.els12"}]}],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1+deb12u5"}]}],"versions":["3.2.7-1","3.2.7-1+deb12u1","3.2.7-1+deb12u2","3.2.7-1+deb12u3","3.2.7-1+deb12u4"]},{"source":"osv","ecosystem":"Debian:13","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+ds1-5+deb13u3"}]}],"versions":["3.4.1+ds1-5","3.4.1+ds1-5+deb13u1","3.4.1+ds1-5+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3+ds1-1"}]}],"versions":["3.4.1+ds1-5","3.4.1+ds1-6","3.4.1+ds1-7","3.4.1+ds1-8~exp1","3.4.2+ds1-1","3.4.2+ds1-2"]},{"source":"osv","ecosystem":"Julia","package":"rsync_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.4.4+0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-4.1.mga10"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:9","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1.5.mga9"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-13.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-13.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-13.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-27.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-27.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-27.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-27.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-7.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-7.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-7.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rsync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-7.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rsync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-7.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-27.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-7.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-160000.4.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-160000.4.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-2ubuntu0.4+esm3"}]}],"versions":["3.0.9-4ubuntu1","3.1.0-2","3.1.0-2ubuntu0.1","3.1.0-2ubuntu0.2","3.1.0-2ubuntu0.3","3.1.0-2ubuntu0.4","3.1.0-2ubuntu0.4+esm1","3.1.0-2ubuntu0.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3ubuntu1.3+esm5"}]}],"versions":["3.1.1-3","3.1.1-3ubuntu1","3.1.1-3ubuntu1.1","3.1.1-3ubuntu1.2","3.1.1-3ubuntu1.3","3.1.1-3ubuntu1.3+esm1","3.1.1-3ubuntu1.3+esm2","3.1.1-3ubuntu1.3+esm3","3.1.1-3ubuntu1.3+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2.1ubuntu1.6+esm3"}]}],"versions":["3.1.2-2","3.1.2-2.1","3.1.2-2.1ubuntu1","3.1.2-2.1ubuntu1.1","3.1.2-2.1ubuntu1.2","3.1.2-2.1ubuntu1.3","3.1.2-2.1ubuntu1.4","3.1.2-2.1ubuntu1.5","3.1.2-2.1ubuntu1.6","3.1.2-2.1ubuntu1.6+esm1","3.1.2-2.1ubuntu1.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-8ubuntu0.9+esm1"}]}],"versions":["3.1.3-6","3.1.3-8","3.1.3-8ubuntu0.1","3.1.3-8ubuntu0.2","3.1.3-8ubuntu0.3","3.1.3-8ubuntu0.4","3.1.3-8ubuntu0.5","3.1.3-8ubuntu0.7","3.1.3-8ubuntu0.8","3.1.3-8ubuntu0.9"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-0ubuntu0.22.04.6"}]}],"versions":["3.2.3-4ubuntu1","3.2.3-4ubuntu2","3.2.3-8ubuntu1","3.2.3-8ubuntu2","3.2.3-8ubuntu3","3.2.3-8ubuntu3.1","3.2.7-0ubuntu0.22.04.2","3.2.7-0ubuntu0.22.04.3","3.2.7-0ubuntu0.22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1ubuntu1.4"}]}],"versions":["3.2.7-1","3.2.7-1build1","3.2.7-1build2","3.2.7-1ubuntu1","3.2.7-1ubuntu1.1","3.2.7-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+ds1-5ubuntu1.2"}]}],"versions":["3.4.1+ds1-3","3.4.1+ds1-4","3.4.1+ds1-5","3.4.1+ds1-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+ds1-7ubuntu0.2"}]}],"versions":["3.4.1+ds1-5ubuntu1","3.4.1+ds1-6","3.4.1+ds1-7"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-1.1"}]}],"bundled":6}],"products":[{"vendor":"red hat","product":"red hat discovery 2"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift container platform 4.22"},{"vendor":"rsyncproject","product":"rsync"},{"vendor":"samba","product":"rsync"}],"references":[{"url":"https://github.com/RsyncProject/rsync/pull/895/changes/8471fdd1561049ef5f58df44a1811a50bd9a531d","tags":["issue-tracking","patch","Patch","fix","web"]},{"url":"https://github.com/RsyncProject/rsync/releases/tag/v3.4.3","tags":["release-notes","Release Notes","advisory","web"]},{"url":"https://michael.stapelberg.ch/posts/2026-05-24-minimal-memory-safe-go-rsync-vulns/","tags":["technical-description","article","web"]},{"url":"https://www.vulncheck.com/advisories/rsync-toctou-race-condition-allows-symlink-based-arbitrary-file-write","tags":["third-party-advisory","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-29518","tags":["vdb-entry","x_refsource_REDHAT","report","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2469055","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29518.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54769","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26332","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26410","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26408","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:29197","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29518","tags":["web","advisory"]},{"url":"https://michael.stapelberg.ch/posts/2026-05-24-minimal-memory-safe-go-rsync-vulns","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pfv9-gp3h-73xv","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-29518","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43618","tags":["report"]},{"url":"https://bugzilla.redhat.com/2469054","tags":["report"]},{"url":"https://bugzilla.redhat.com/2469055","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-26332.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-26408.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-26410.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-29518","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1779694338.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1779694460.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1779694727.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1779694887.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1779746464.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1779746676.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1779747925.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1779822401.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1779823985.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1779824462.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1779869103.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1780480701.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1780513862.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1782739272.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41035","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1788335736.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53786","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53789","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53790","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53792","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70452","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70453","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70456","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70458","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70459","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70461","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70462","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70463","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70464","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1789745909.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53785","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1791331076.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53793","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1791331932.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1791907584.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1791908277.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43619","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29518.json","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-29518","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0265.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35562","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/20/6","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00193.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/FBOANNVT2JXHE24DJ2WIYE2BNCWRGT24/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/4RPOIF6TVE233FKZN5TAC6XTNQ5WVFYL/","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/08/1","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8349-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8349-2","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4752","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43617","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4753","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4754","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2469054","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-181630","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26332.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-29518","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43618","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43618","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26408.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26410.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:26332","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:26408","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:26410","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262038-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234100","tags":["report"]},{"url":"https://bugzilla.suse.com/1234101","tags":["report"]},{"url":"https://bugzilla.suse.com/1234102","tags":["report"]},{"url":"https://bugzilla.suse.com/1234103","tags":["report"]},{"url":"https://bugzilla.suse.com/1234104","tags":["report"]},{"url":"https://bugzilla.suse.com/1235475","tags":["report"]},{"url":"https://bugzilla.suse.com/1254441","tags":["report"]},{"url":"https://bugzilla.suse.com/1262223","tags":["report"]},{"url":"https://bugzilla.suse.com/1264511","tags":["report"]},{"url":"https://bugzilla.suse.com/1264512","tags":["report"]},{"url":"https://bugzilla.suse.com/1264513","tags":["report"]},{"url":"https://bugzilla.suse.com/1264514","tags":["report"]},{"url":"https://bugzilla.suse.com/1264515","tags":["report"]},{"url":"https://bugzilla.suse.com/1265296","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45232","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262048-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262083-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621726-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1201840","tags":["report"]},{"url":"https://bugzilla.suse.com/1202970","tags":["report"]},{"url":"https://bugzilla.suse.com/1204538","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29154","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621739-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621980-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622015-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263629-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-29518","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8283-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8349-3","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-29518","title":"Rsync \u003c 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write","description":"Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.","status":"published","published":"2026-05-20T12:48:07.656Z","modified":"2026-11-08T14:01:55.183Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-367","CWE-367"],"updated_at":"2026-11-08T15:43:32.737211Z"}],"euvd":[{"id":"EUVD-2026-31100","description":"Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.","status":"published","published":"2026-05-20T12:48:07Z","modified":"2026-11-08T14:01:55Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-08T15:13:09.268962Z"}],"ghsa":[{"id":"GHSA-pfv9-gp3h-73xv","title":"Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in...","description":"Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.","status":"published","published":"2026-05-20T15:35:30Z","modified":"2026-08-19T12:33:11Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T15:10:38.677871Z"}],"nvd":[{"id":"CVE-2026-29518","description":"Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.","status":"published","published":"2026-05-20T13:16:17.04Z","modified":"2026-08-19T12:17:41.96Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:12:19.752984Z"}],"osv":[{"id":"ALPINE-CVE-2026-29518","description":"Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.","status":"published","published":"2026-05-20T13:16:17.04Z","modified":"2026-10-01T02:17:49.232424156Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-29518","status":"published","published":"2026-05-21T06:10:47.152151Z","modified":"2026-05-26T07:15:10.71248934Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.315185Z"},{"id":"CVE-2026-29518","title":"Rsync \u003c 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write","description":"Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.","status":"published","published":"2026-05-20T12:48:07.656Z","modified":"2026-11-09T02:47:18.903291723Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-367"],"updated_at":"2026-11-09T03:16:17.543303Z"},{"id":"DEBIAN-CVE-2026-29518","description":"Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.","status":"published","published":"2026-05-20T13:16:17.04Z","modified":"2026-10-01T03:03:21.44260235Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"JLSEC-2026-626","title":"Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon...","description":"Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.","status":"published","published":"2026-06-25T17:41:14.392Z","modified":"2026-07-25T18:23:57.977762357Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2026-4752","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026amp;quot;rsync algorithm\u0026amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\n\nRsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.(CVE-2026-29518)\n\nRsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon\u0026apos;s hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.(CVE-2026-43617)","status":"published","published":"2026-11-11T12:25:49Z","modified":"2026-11-11T12:45:06.395803715Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"OESA-2026-4753","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026amp;quot;rsync algorithm\u0026amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\n\nRsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.(CVE-2026-29518)\n\nRsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon\u0026apos;s hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.(CVE-2026-43617)","status":"published","published":"2026-11-11T12:25:49Z","modified":"2026-11-11T12:45:11.075243074Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"OESA-2026-4754","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026amp;quot;rsync algorithm\u0026amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\n\nRsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.(CVE-2026-29518)\n\nRsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon\u0026apos;s hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.(CVE-2026-43617)","status":"published","published":"2026-11-11T12:25:50Z","modified":"2026-11-11T12:45:05.283241133Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"RHSA-2026:26332","title":"Red Hat Security Advisory: rsync security, bug fix, and enhancement update","status":"published","published":"2026-06-17T10:08:44Z","modified":"2026-10-09T10:23:47Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:26408","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2026-06-17T10:08:48Z","modified":"2026-10-09T10:23:48Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:26410","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2026-06-17T10:08:49Z","modified":"2026-10-09T10:23:49Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RLSA-2026:26332","title":"Important: rsync security, bug fix, and enhancement update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618)\n\n* rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518)\n\nBug Fix(es) and Enhancement(s):\n\n* Rebase rsync to version 3.4.4 in Rocky Linux10 (JIRA:Rocky Linux-181630)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-19T06:04:41.448408Z","modified":"2026-06-19T06:30:08.969156446Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:26408","title":"Important: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618)\n\n* rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-17T06:00:15.788686Z","modified":"2026-06-17T06:30:05.824421052Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:26410","title":"Important: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618)\n\n* rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-17T12:03:08.073041Z","modified":"2026-06-17T12:30:06.077815028Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"UBUNTU-CVE-2026-29518","description":"Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.","status":"published","published":"2026-05-20T00:00:00Z","modified":"2026-06-30T18:17:47.076879839Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:11.640778Z"},{"id":"ALSA-2026:26332","title":"Important: rsync security, bug fix, and enhancement update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.  \n\nSecurity Fix(es):  \n\n  * rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618)\n  * rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Rebase rsync to version 3.4.4 in AlmaLinux10 (JIRA:AlmaLinux-181630)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-16T00:00:00Z","modified":"2026-10-29T11:30:18.733470613Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:26408","title":"Important: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.  \n\nSecurity Fix(es):  \n\n  * rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618)\n  * rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-16T00:00:00Z","modified":"2026-10-29T11:02:23.865606374Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:26410","title":"Important: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.  \n\nSecurity Fix(es):  \n\n  * rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618)\n  * rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-16T00:00:00Z","modified":"2026-10-29T11:32:34.078702418Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"AZL-87012","title":"CVE-2026-29518 affecting package rsync for versions less than 3.4.3-1","description":"Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.","status":"published","published":"2026-05-20T13:16:17Z","modified":"2026-08-28T17:57:00.370312Z","updated_at":"2026-11-02T15:28:10.677811Z"},{"id":"CLSA-2026-1779694338","title":"rsync: Fix of CVE-2026-29518","description":"- CVE-2026-29518: fix daemon-no-chroot sender TOCTOU symlink race by\n  opening source files via secure_relative_open() from module root","status":"published","published":"2026-05-25T07:32:21Z","modified":"2026-06-01T00:33:14.891347695Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779694460","title":"Fix CVE(s): CVE-2026-29518","description":"   * SECURITY UPDATE: daemon-no-chroot TOCTOU symlink race\n     - debian/patches/CVE-2026-29518.patch: track per-module chroot in\n       am_chrooted and use_secure_symlinks; route the sender's read-path\n       open, the receiver's basis-file open, mkstemp, and inplace write\n       through secure_relative_open() / secure_mkstemp()\n     - CVE-2026-29518","status":"published","published":"2026-05-25T07:34:24Z","modified":"2026-06-04T10:03:47.69825Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779694727","title":"Fix CVE(s): CVE-2026-29518","description":"   * SECURITY UPDATE: daemon-no-chroot TOCTOU symlink race\n     - debian/patches/CVE-2026-29518.patch: track per-module chroot in\n       am_chrooted and use_secure_symlinks; route the sender's read-path\n       open, the receiver's basis-file open, mkstemp, and inplace write\n       through secure_relative_open() / secure_mkstemp()\n     - CVE-2026-29518","status":"published","published":"2026-05-25T07:38:50Z","modified":"2026-06-04T10:04:29.682689Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779694887","title":"rsync: Fix of CVE-2026-29518","description":"- CVE-2026-29518: fix daemon-no-chroot TOCTOU symlink race by tracking\n  per-module chroot in am_chrooted, routing sender read-path, receiver\n  basis-file open, mkstemp, and inplace write through\n  secure_relative_open() / secure_mkstemp()","status":"published","published":"2026-05-25T07:41:30Z","modified":"2026-06-01T00:31:35.940402534Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779746464","title":"rsync: Fix of CVE-2026-29518","description":"- CVE-2026-29518: fix TOCTOU symlink race in daemon file handling\n  exposed when \"use chroot = no\"","status":"published","published":"2026-05-25T22:01:09Z","modified":"2026-10-26T09:31:57.617997269Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779746676","title":"rsync: Fix of CVE-2026-29518","description":"- CVE-2026-29518: fix TOCTOU symlink race in daemon file handling\n  exposed when \"use chroot = no\"","status":"published","published":"2026-05-25T22:04:41Z","modified":"2026-10-26T09:31:54.458159575Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779747925","title":"rsync: Fix of CVE-2026-29518","description":"- CVE-2026-29518: fix TOCTOU symlink race in daemon file handling\n  exposed when \"use chroot = no\"","status":"published","published":"2026-05-26T09:19:04Z","modified":"2026-10-26T09:31:42.001469235Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779822401","title":"rsync: Fix of CVE-2026-29518","description":"- CVE-2026-29518: fix sender read-path TOCTOU by routing the daemon open\n  through secure_relative_open() from the trusted module_dir root","status":"published","published":"2026-05-26T19:06:50Z","modified":"2026-10-26T09:31:05.643939329Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779823985","title":"rsync: Fix of 2 CVEs","description":"- CVE-2026-43618: fix integer overflow in compressed-token decoding that\n  could leak rsync process memory contents over the wire\n- CVE-2026-29518: fix TOCTOU race on parent path components in non-chroot\n  daemon by routing receiver/sender opens, chmod, and chdir through per-\n  component O_NOFOLLOW secure variants gated on use_secure_symlinks","status":"published","published":"2026-05-26T19:33:09Z","modified":"2026-10-26T09:43:27.036909305Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779824462","title":"rsync: Fix of 2 CVEs","description":"- CVE-2026-43618: fix integer overflow in compressed-token decoding that\n  could leak rsync process memory contents over the wire\n- CVE-2026-29518: fix TOCTOU race on parent path components in non-chroot\n  daemon by routing receiver/sender opens, chmod, and chdir through per-\n  component O_NOFOLLOW secure variants gated on use_secure_symlinks","status":"published","published":"2026-05-26T19:41:06Z","modified":"2026-10-26T09:43:30.700628116Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779869103","title":"Fix CVE(s): CVE-2024-12086, CVE-2026-29518, CVE-2026-43618","description":"   * SECURITY UPDATE: receiver process memory disclosure via compressed-token\n     integer overflow:\n     - debian/patches/els/0004-CVE-2026-43618.patch: cap rx_token at\n       MAX_TOKEN_INDEX; reject out-of-range token values.\n     - CVE-2026-43618.\n   * SECURITY UPDATE: malicious server can enumerate arbitrary client files\n     via crafted checksum responses:\n     - debian/patches/els/0005-CVE-2024-12086.patch: add secure_relative_open()\n       and route the receiver's basis-file open through it.\n     - CVE-2024-12086.\n   * SECURITY UPDATE: daemon TOCTOU symlink race on parent path components\n     when \"use chroot = no\":\n     - debian/patches/els/0006-CVE-2026-29518.patch: gate sender/receiver\n       opens and chmods through secure_relative_open() / do_chmod_at().\n     - CVE-2026-29518.","status":"published","published":"2026-05-27T08:05:13Z","modified":"2026-06-04T10:03:14.701516Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1780480701","title":"rsync: Fix of CVE-2026-29518","description":"- CVE-2026-29518: fix daemon-no-chroot TOCTOU on parent path components by\n  routing both the sender read-path (sender.c) and the receiver write-path\n  (receiver.c open_tmpfile and recv_files inplace branch) through\n  secure_relative_open() / secure_mkstemp() from the trusted module root,\n  and add regression test (chdir-symlink-race.test case 4)","status":"published","published":"2026-06-03T09:58:34Z","modified":"2026-10-26T09:30:16.236976154Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780513862","title":"rsync: Fix of CVE-2026-29518","description":"- Add .bs_config for centos8.4els platform (mock dist .el8_4)\n- CVE-2026-29518: fix daemon-no-chroot TOCTOU symlink race by tracking\n  per-module chroot in am_chrooted, routing sender read-path, receiver\n  basis-file open, mkstemp, and inplace write through\n  secure_relative_open() / secure_mkstemp()","status":"published","published":"2026-06-03T19:11:16Z","modified":"2026-10-26T09:31:49.605620807Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1782739272","title":"Fix CVE(s): CVE-2026-29518, CVE-2026-41035","description":"   * PACKAGING FIX: rsync daemon default group on stock Ubuntu/Debian (ELSR-8050)\n     - the daemon's compile-time NOBODY_GROUP was resolved to \"nobody\" by the\n       focal build chroot's /etc/group, but stock Ubuntu/Debian have only\n       \"nogroup\", so daemon modules with no explicit gid were rejected with\n       \"@ERROR: invalid gid nobody\" (test_daemon / ELSR-8050)\n     - debian/rules: build with rsync's own --with-nobody-group=nogroup\n       configure option so the compile-time NOBODY_GROUP default is baked as\n       \"nogroup\" regardless of the build chroot, matching the stock\n       Ubuntu/Debian rsync build (fixes modules with no explicit gid)\n     - debian/patches/rsync-daemon-nobody-group-fallback.patch: in the daemon's\n       add_a_group() resolve a \"nobody\" group to \"nogroup\" at runtime when the\n       host has no \"nobody\" group, so a module that explicitly sets\n       \"gid = nobody\" is also honoured on stock Ubuntu/Debian instead of being\n       rejected with \"@ERROR: invalid gid nobody\"; any other unresolvable group\n       is still rejected\n     - upstream: configure.ac AC_ARG_WITH(nobody-group)\n       https://github.com/RsyncProject/rsync/blob/v3.1.3/configure.ac#L142-L157\n       Debian bugs #144570 (https://bugs.debian.org/144570) and #25299\n     - ELSR-8050","status":"published","published":"2026-06-29T13:21:30Z","modified":"2026-10-26T09:32:05.332808732Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1788335736","title":"Fix of 13 CVEs","description":"   * SECURITY UPDATE: peer-driven one-byte heap out-of-bounds write in\n     add_implied_include() from a files-from entry carrying both an interior\n     and a trailing backslash:\n     - debian/patches/els/0009-CVE-2026-70461.patch: count a trailing\n       backslash when sizing the appended-wildcard pattern.\n     - CVE-2026-70461.\n   * SECURITY UPDATE: heap out-of-bounds write in read_args() when the peer's\n     argument count lands exactly on the argv allocation:\n     - debian/patches/els/0010-CVE-2026-70456.patch: reserve room for the\n       trailing NULL terminator.\n     - CVE-2026-70456.\n   * SECURITY UPDATE: out-of-bounds write from a file entry marked\n     FLAG_HLINKED that the receiver accepted with hard-link preservation\n     inactive:\n     - debian/patches/els/0011-CVE-2026-70458.patch: gate FLAG_HLINKED on\n       preserve_hard_links and exclude directories.\n     - CVE-2026-70458.\n   * SECURITY UPDATE: sender-side out-of-bounds read driven by a malicious\n     receiver's checksum header with a non-zero block count and a zero block\n     length:\n     - debian/patches/els/0012-CVE-2026-53792.patch: reject a zero block\n       length in read_sum_head().\n     - CVE-2026-53792.\n   * SECURITY UPDATE: CPU exhaustion in the sending process via\n     quadratic-time behaviour in hash_search(), driven by a malicious\n     receiver's crafted equal-weak-checksum block list. The attacker is the\n     receiver, but the cycles burned are the sender's: hash_search() is\n     reached only through match_sums(), whose sole caller is send_files() in\n     sender.c. NVD's text attributes the CPU to the receiver; the direction\n     stated here is what the code does:\n     - debian/patches/els/0013-CVE-2026-70453.patch: bound the per-offset\n       chain walk.\n     - CVE-2026-70453.\n   * SECURITY UPDATE: daemon \"hosts deny\" failing open when a configured\n     hostname token cannot be resolved:\n     - debian/patches/els/0014-CVE-2026-70452.patch: treat an unresolvable\n       deny-list token as a match.\n     - CVE-2026-70452.\n   * SECURITY UPDATE: daemon \"auth users\" ignoring its documented comma-only\n     parsing, silently discarding a deny rule that names a group whose name\n     contains a space:\n     - debian/patches/els/0015-CVE-2026-70463.patch: parse the list with\n       conf_strtok().\n     - CVE-2026-70463.\n   * SECURITY UPDATE: peer-supplied MSG_IO_TIMEOUT disabling the client's own\n     I/O timeout through a non-positive or overflowing value:\n     - debian/patches/els/0016-CVE-2026-70462.patch: cap the received value\n       and make set_io_timeout() arithmetic overflow-safe.\n     - CVE-2026-70462.\n   * SECURITY UPDATE: client-supplied --filter merge file bypassing the daemon\n     module filter list:\n     - debian/patches/els/0017-CVE-2026-53786.patch: strip the module-dir\n       prefix before the daemon-filter check.\n     - CVE-2026-53786.\n   * SECURITY UPDATE: per-connection daemon child crash on a crafted first\n     incremental file list whose transfer root is a non-directory dot entry:\n     - debian/patches/els/0018-CVE-2026-70459.patch: reject a non-directory\n       transfer-root entry and require a dir_flist entry before trusting\n       parent_ndx 0.\n     - CVE-2026-70459.\n   * SECURITY UPDATE: malicious sender widening the receiver's --delete scope\n     beyond the destination subtree via implied-parent reclassification:\n     - debian/patches/els/0019-CVE-2026-53789.patch: force implied-parent\n       directories non-content on the receiver, including the synthetic\n       transfer root and the pre-protocol-30 encoding.\n     - CVE-2026-53789.\n   * SECURITY UPDATE: unauthenticated pre-transfer handshake stall holding a\n     per-connection daemon child past the module's max connections limit:\n     - debian/patches/els/0020-CVE-2026-70464.patch: bound every\n       peer-controlled handshake read with an absolute deadline and cap the\n       early-protocol argument count.\n     - CVE-2026-70464.\n   * SECURITY UPDATE: command and argument injection through the\n     RSYNC_CONNECT_PROG %H host substitution, through unquoted arguments in a\n     --write-batch replay script, and through remote-shell argument quoting\n     that did not escape the newline, the carriage return or the backtick:\n     - debian/patches/els/0021-CVE-2026-53790.patch: shell-quote and validate\n       the connect host, and quote every replay-script argument.\n     - debian/patches/els/0025-CVE-2026-53790-safe-arg-shell-chars.patch: add\n       the newline, the carriage return and the backtick to safe_arg()'s\n       SHELL_CHARS escape set. safe_arg() escapes metacharacters because the\n       remote end is reached as \"ssh \u003chost\u003e rsync --server ...\", where ssh\n       joins the command words and the remote sshd hands the string to the\n       remote user's login shell, which re-parses it; an unescaped newline\n       therefore ended the transfer command and ran what followed, and an\n       unescaped backtick opened a command substitution. This package\n       acquired safe_arg() from els/0001-CVE-2022-29154.patch, whose donor\n       predates the backtick's addition upstream.\n     - Partial fix: the daemon %RSYNC_*% exec-hook expansions do not exist in\n       3.1.3 and rsync-ssl is not installed by debian/rules, so those two of\n       the four sinks named in the advisory are not present in this package.\n     - CVE-2026-53790.\n   * SECURITY UPDATE: further out-of-bounds F_SUM() reads where the checksum\n     extra slot was never reserved -- a daemon sender with \"%C\" in its log\n     format, a hard-linked non-regular entry compared against a basis dir,\n     and \"%C\" on a deletion:\n     - debian/patches/els/0022-CVE-2026-70458.patch: set\n       sender_keeps_checksum in start_server(), require S_ISREG(file-\u003emode)\n       before the content compare in hard_link_check(), and skip the\n       checksum for an ITEM_DELETED entry.\n     - CVE-2026-70458.\n   * Drop two peer-reachable assert() aborts (no CVE assigned; carried from\n     the same upstream commit as several of the fixes above, and live in the\n     shipped binary because nothing in the build defines NDEBUG):\n     - debian/patches/els/0023-peer-reachable-asserts.patch: turn an\n       undeclared cross-flist hard-link gnum into a protocol error instead of\n       an assert, and stop asserting !is_utf8 when a daemon receiver\n       forwards a peer message to the generator.\n   * Bound merge-file include recursion (no CVE assigned; the remaining\n     peer-reachable crash hunk of the same upstream commit several of the\n     fixes above come from). A merge file's content may name another merge\n     file, so parse_filter_file() re-enters itself with a BIGPATHBUFLEN\n     stack buffer per level; a self-referencing per-directory merge file,\n     whose content the peer supplies through the transferred tree, recursed\n     until the stack was exhausted (SIGSEGV):\n     - debian/patches/els/0024-merge-file-depth-cap.patch: add\n       MAX_MERGE_DEPTH and a nesting counter.\n   * Add committed regression tests to the shipped test suite for the six\n     fixes that a black-box test can observe, each carried by the patch it\n     proves and each failing without that patch:\n     - testsuite/cve-2026-70452.test (els/0014), an unresolvable \"hosts deny\"\n       token must deny.\n     - testsuite/cve-2026-70463.test (els/0015), the first word of a\n       space-bearing \"auth users\" entry must not become an allow rule.\n     - testsuite/cve-2026-53786.test (els/0017), a daemon filter rule must\n       govern a client merge file, and an \"exclude from\" path that only shares\n       the module path's textual prefix must not be truncated.\n     - testsuite/cve-2026-53790.test (els/0021), a newline-bearing filter rule\n       must not reach the replay script and an injected RSYNC_CONNECT_PROG %H\n       host must not execute.\n     - testsuite/cve-2026-53790-shell-chars.test (els/0025), a newline, a\n       carriage return or a backtick in a path must not execute a command on\n       the remote shell, and an ordinary transfer over the same remote shell\n       must still work.\n     - testsuite/cve-2026-70458.test (els/0022), the daemon's logged \"%C\" must\n       be the file's checksum, not adjacent pool memory.\n     - testsuite/merge-depth.test (els/0024), a self-referencing merge file\n       must be refused, not crash the process.\n     - testsuite/cve-2026-53790-safe-arg-uninit.test (els/0027), a trailing\n       backslash in a path must reach the remote shell doubled, and no stray\n       byte may follow a path that carries a backslash.\n   * SECURITY UPDATE: safe_arg() sized its result one byte larger than it\n     wrote for every backslash that precedes a wildcard and for a trailing\n     backslash, so the closing NUL landed past the last byte written and\n     uninitialised heap was returned inside the string handed to the remote\n     shell (--protect-args is off by default in 3.1.3). The same defect left a\n     trailing backslash unescaped there, where it escapes the following space\n     and joins the next word:\n     - debian/patches/els/0027-CVE-2026-53790-safe-arg-uninit.patch: make the\n       escape counter mirror the writer and guard the WILD_CHARS lookup with\n       f[1]. Upstream's own stable-branch backport (1aef79e1 on\n       v3.2.7-sec-patches3, from 22efd249), applied unchanged.\n     - CVE-2026-53790.\n   * SECURITY UPDATE: a fourth out-of-bounds F_SUM() read, specific to this\n     package. generator.c unchanged_file() guards the checksum compare on the\n     destination's on-disk mode while the slot is reserved from the\n     peer-supplied file-\u003emode; Debian's copy-devices.diff lets a device entry\n     reach it, so with -c --copy-devices a sender's device entry whose\n     destination is an existing regular file reads below its pool slot:\n     - debian/patches/els/0030-CVE-2026-70458-copy-devices.patch: require\n       S_ISREG(file-\u003emode) as well.\n     - CVE-2026-70458.\n   * Carry the four remaining hunks of upstream 3eeedf8d that land in\n     functions this series already patches (no CVE assigned; the same\n     malicious-peer hardening commit seven of the patches above cite):\n     - debian/patches/els/0026-donor-parity-3eeedf8d.patch: re-check the block\n       length before adopting want_i in hash_search(), clamp a peer-supplied\n       s-\u003eflength to the local length in match_sums(), and refuse a sub-flist\n       that arrives after the final flist was freed or that names a cleared\n       dir_flist slot in recv_file_list().\n   * Fix secure_relative_open() never returning a directory descriptor. The\n     per-component walk only assigned the result in its ENOTDIR arm, so a\n     path that resolved to a directory fell through to \"errno = EINVAL\" and\n     returned -1. Every permission change on a daemon receiver running with\n     \"use chroot = no\" therefore failed with \"failed to set permissions ...\n     Invalid argument (22)\" and the transfer exited 23. Introduced by\n     els/0006-CVE-2026-29518.patch, which added both the helper and its\n     O_DIRECTORY callers:\n     - debian/patches/els/0029-secure-relative-open-dirfd.patch.\n   * Run the upstream testsuite during the build, so the regression tests\n     above are load-bearing:\n     - debian/patches/els/0028-testsuite-harness.patch: add the missing\n       syscall.o stubs (noatime, am_daemon, am_chrooted) to tls.c,\n       trimslash.c and t_unsafe.c, without which \"make check\" could not even\n       link its helper programs, and let runtests.sh honour a $skiptests list.\n     - debian/rules: run \"make check\" from build-stamp unless\n       DEB_BUILD_OPTIONS=nocheck, excluding devices and devices-fake, which\n       fail identically on 3.1.3 with only the Debian patches applied.","status":"published","published":"2026-09-02T07:58:24Z","modified":"2026-10-26T09:43:29.311029583Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1789745909","title":"Fix CVE(s): CVE-2026-53785","description":"   * SECURITY UPDATE: Destination-tree escape via symlink following in\n     --relative implied-parent handling\n     - debian/patches/CVE-2026-53785.patch: resolve the receiver's destination\n       names one component at a time with O_NOFOLLOW|O_DIRECTORY, acting\n       against a directory fd that is held open, instead of handing the whole\n       name to the kernel to resolve; a component that is a symlink is now\n       refused rather than traversed, so nothing the receiver creates lands at\n       the symlink's target outside the destination tree; adds\n       secure_relative_dirfd(), do_mkdir_at(), do_stat_at(), do_open_at(),\n       do_rename_at(), do_symlink_at(), do_mknod_at() and do_link_at() in\n       syscall.c and routes every way the receiver creates something at a\n       destination name through them -- make_path() in util.c, the four\n       implied-parent sites in generator.c, the install-into-final-name\n       renames in util.c, rsync.c, receiver.c and generator.c, copy_file()'s\n       reopen of the destination on the cross-filesystem fallback, the\n       symlink and mknod creations in generator.c's atomic_create(), and the\n       --link-dest and -H hard links in generator.c and hlink.c; each of\n       those is its own route to the destination name, reached by a different\n       option (--temp-dir bypasses the file create entirely, --devices /\n       --specials and a transferred symlink never touch it, and --link-dest\n       installs a regular file's link from hlink.c but a non-regular file's\n       from generator.c), so confining only some of them leaves the escape\n       open; extends the existing secure_mkstemp() and secure_relative_open()\n       receiver create paths, which the CVE-2026-29518 fix gated on\n       daemon-no-chroot only, to the same confinement; the confinement covers\n       a chrooted daemon serving an inner-module \"/./\" boundary, whose module\n       root the kernel chroot does not confine, and exempts --keep-dirlinks\n       only for a local receiver, whose documented purpose is to follow a\n       symlinked destination directory -- never for a daemon or for the\n       server side of a push, where the option arrives from the peer; only\n       the confinement this CVE needs is carried, not upstream's whole-tree\n       dirfd-stack resolver, which assumes a source layout this version does\n       not have; defines am_daemon, am_chrooted, am_server, local_server and\n       keep_dirlinks in t_stub.c, which the standalone test harnesses link in\n       place of options.c and main.c, so debian/rules' check target still\n       builds; and adds testsuite/cve-2026-53785.test\n     - CVE-2026-53785","status":"published","published":"2026-09-18T15:38:40Z","modified":"2026-10-26T09:43:51.828408273Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1791331076","title":"rsync: Fix of 5 CVEs","description":"- CVE-2026-53790: refuse a shell-active RSYNC_CONNECT_PROG %H host and\n  quote it; escape backtick, newline and carriage return in remote-shell\n  arguments\n- CVE-2026-53793: confine a \"/./\" inner-module chroot: secure\n  opens, change_dir, chmod, rename, delta-basis opens and alt-dest basis\n  stats, resolved with an in-tree-symlink-following walk so in-module\n  symlinks and --link-dest=../dir keep working; also sanitize a\n  fuzzy-basis xname on the client\n- CVE-2026-70453: cap the per-offset hash_search() chain walk at\n  MAX_CHAIN_LEN\n- CVE-2026-70458: refuse FLAG_HLINKED without -H or on a directory, and\n  skip the checksum basis match for a non-regular hard-linked entry\n- CVE-2026-70464: bound the daemon's pre-transfer handshake reads with an\n  absolute deadline and cap daemon argument lists\n- CVE-2026-29518: rebuild the module-relative path for the daemon\n  sender's confined open, fixing \"file has vanished\" for a file fetched\n  by name from a subdirectory of a \"use chroot = no\" module","status":"published","published":"2026-10-06T23:58:09Z","modified":"2026-10-26T09:43:54.391311126Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791331932","title":"rsync: Fix of 5 CVEs","description":"- CVE-2026-53790: refuse a shell-active RSYNC_CONNECT_PROG %H host and\n  quote it; escape backtick, newline and carriage return in remote-shell\n  arguments\n- CVE-2026-53793: confine a \"/./\" inner-module chroot: secure\n  opens, change_dir, chmod, rename, delta-basis opens and alt-dest basis\n  stats, resolved with an in-tree-symlink-following walk so in-module\n  symlinks and --link-dest=../dir keep working; also sanitize a\n  fuzzy-basis xname on the client\n- CVE-2026-70453: cap the per-offset hash_search() chain walk at\n  MAX_CHAIN_LEN\n- CVE-2026-70458: refuse FLAG_HLINKED without -H or on a directory, and\n  skip the checksum basis match for a non-regular hard-linked entry\n- CVE-2026-70464: bound the daemon's pre-transfer handshake reads with an\n  absolute deadline and cap daemon argument lists\n- CVE-2026-29518: rebuild the module-relative path for the daemon\n  sender's confined open, fixing \"file has vanished\" for a file fetched\n  by name from a subdirectory of a \"use chroot = no\" module","status":"published","published":"2026-10-08T22:07:12Z","modified":"2026-10-26T09:43:12.604117678Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791907584","title":"rsync: Fix of 5 CVEs","description":"- CVE-2026-29518: re-implement the \"use chroot = no\" confinement after the\n  centos7els fix: every path operation proves its parent directory beneath\n  the pinned module root through /proc/self/fd and runs on it with the\n  *at() calls.  In-module symlinks, directories the daemon uid may search\n  but not read, -L/-K and --link-dest=../dir keep working; xattrs, ACLs and\n  timestamps are confined too.  Drop CVE-2026-29518-2.patch\n- CVE-2026-43619: chmod no longer follows a leaf symlink; CVE-2026-29518:\n  confined calls act on the resolved object with O_NOFOLLOW\n- CVE-2026-29518: anchor the receiver's basis open at the pinned working\n  directory and prove it beneath the module, not beneath a root resolved\n  by name\n- CVE-2026-53784, CVE-2026-53786, CVE-2026-53793: re-anchor on the\n  re-implemented CVE-2026-29518 confinement","status":"published","published":"2026-10-13T16:56:35Z","modified":"2026-10-26T09:31:54.705874524Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791908277","title":"rsync: Fix of CVE-2026-43619","description":"- CVE-2026-29518: re-implement the \"use chroot = no\" confinement after the\n  centos7els fix: every path operation proves its parent directory beneath\n  the pinned module root through /proc/self/fd and runs on it with the\n  *at() calls.  In-module symlinks, directories the daemon uid may search\n  but not read, -L/-K and --link-dest=../dir keep working; xattrs, ACLs and\n  timestamps are confined too.  Drop CVE-2026-29518-2.patch\n- CVE-2026-43619: chmod no longer follows a leaf symlink; CVE-2026-29518:\n  confined calls act on the resolved object with O_NOFOLLOW\n- CVE-2026-29518: anchor the receiver's basis open at the pinned working\n  directory and prove it beneath the module, not beneath a root resolved\n  by name\n- CVE-2026-53784, CVE-2026-53786, CVE-2026-53793: re-anchor on the\n  re-implemented CVE-2026-29518 confinement","status":"published","published":"2026-10-17T13:12:59Z","modified":"2026-10-26T09:43:30.811673969Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"MGASA-2026-0265","title":"Updated rsync package fixes security vulnerabilities","description":"The updated package fixes security vulnerabilities:\nRsync \u003c 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File\nWrite. (CVE-2026-29518)\nRsync \u003c 3.4.3 Authorization Bypass via Hostname Resolution.\n(CVE-2026-43617)\nRsync \u003c 3.4.3 Integer Overflow Information Disclosure. (CVE-2026-43618)\nRsync \u003c 3.4.3 Symlink Race Condition via Path-Based Syscalls.\n(CVE-2026-43619)\nRsync \u003c 3.4.3 Out-of-Bounds Array Read via recv_files().\n(CVE-2026-43620)\nRsync \u003c 3.4.3 Off-by-One Stack Write via HTTP Proxy. (CVE-2026-45232)\n","status":"published","published":"2026-07-18T23:55:48Z","modified":"2026-07-19T00:00:04.314738521Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:10857-1","title":"rsync-3.4.3-1.1 on GA media","description":"These are all security issues fixed in the rsync-3.4.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-24T00:00:00Z","modified":"2026-05-25T07:45:05.511446534Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:20877-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).\n- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-06-02T09:13:41Z","modified":"2026-06-04T09:00:10.423530016Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:2038-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n    \n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-41035: Count of entries mismatch can lead to a use-after-free (bsc#1262223)\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-05-21T13:33:41Z","modified":"2026-05-22T09:00:05.164069318Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:2048-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-05-25T13:55:42Z","modified":"2026-05-26T08:15:05.350251039Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:2083-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-05-27T07:56:11Z","modified":"2026-05-28T08:15:05.799079873Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:21726-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\nSecurity issues:\n\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n\nNon security issues:\n\n- rsync --delay-updates never updates after interruption (bsc#1204538).\n- Fix duplication of flag causing illegal hashkey failures.\n","status":"published","published":"2026-05-21T11:04:19Z","modified":"2026-05-23T18:23:40.42363199Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21739-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-05-21T11:23:33Z","modified":"2026-05-23T18:23:41.730720723Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21980-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).\n- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-06-02T09:14:50Z","modified":"2026-06-04T09:00:07.395663315Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22015-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).\n- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-06-02T09:14:50Z","modified":"2026-06-09T18:24:27.804925101Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:3629-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n","status":"published","published":"2026-08-17T16:45:26Z","modified":"2026-08-18T09:30:04.581046211Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}