Fedora alert FEDORA-2026-d6763b4c84 (rsync)
| From: | updates--- via package-announce <package-announce@lists.fedoraproject.org> | |
| To: | package-announce@lists.fedoraproject.org | |
| Subject: | [SECURITY] Fedora 43 Update: rsync-3.5.0-1.fc43 | |
| Date: | Thu, 27 Aug 2026 01:13:07 +0000 | |
| Message-ID: | <20260827011307.A64D31887794@bastion01.rdu3.fedoraproject.org> | |
| Archive-link: | Article |
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-d6763b4c84 2026-08-27 01:10:36.944552+00:00 -------------------------------------------------------------------------------- Name : rsync Product : Fedora 43 Version : 3.5.0 Release : 1.fc43 URL : https://rsync.samba.org/ Summary : A program for synchronizing files over a network Description : Rsync uses a reliable algorithm to bring remote and host files into sync very quickly. Rsync is fast because it just sends the differences in the files over the network instead of sending the complete files. Rsync is often used as a very powerful mirroring process or just as a more capable replacement for the rcp command. A technical report which describes the rsync algorithm is included in this package. -------------------------------------------------------------------------------- Update Information: New version 3.5.0. Includes fixes for following CVEs: CVE-2026-53783, CVE-2026-53784, CVE-2026-53785, CVE-2026-53786, CVE-2026-53788, CVE-2026-53789, CVE-2026-53790, CVE-2026-53791, CVE-2026-53792, CVE-2026-53793, CVE-2026-53794, CVE-2026-53795, CVE-2026-53796, CVE-2026-53797, CVE-2026-53798, CVE-2026-53799, CVE-2026-53800, CVE-2026-53801, CVE-2026-53802, CVE-2026-53803, CVE-2026-70452, CVE-2026-70453, CVE-2026-70454, CVE-2026-70455, CVE-2026-70456, CVE-2026-70457, CVE-2026-70458, CVE-2026-70459, CVE-2026-70460, CVE-2026-70461, CVE-2026-70462, CVE-2026-70463, CVE-2026-70464 -------------------------------------------------------------------------------- ChangeLog: * Wed Aug 19 2026 Michal Ruprich <mruprich@redhat.com> - 3.5.0-1 - New version 3.5.0, cleanup of old patches -------------------------------------------------------------------------------- References: [ 1 ] Bug #2510209 - CVE-2026-43618 rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2510209 [ 2 ] Bug #2515036 - rsync-3.5.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2515036 [ 3 ] Bug #2519495 - CVE-2026-53785 rsync: rsync: Arbitrary file write via path traversal in --relative mode [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2519495 [ 4 ] Bug #2519547 - CVE-2026-53803 rsync: rsync: Local Privilege Escalation via Symlink Following [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2519547 [ 5 ] Bug #2519583 - CVE-2026-70453 rsync: rsync: Denial of Service via Algorithmic Complexity [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2519583 [ 6 ] Bug #2519716 - CVE-2026-53792 rsync: rsync: Denial of Service via out-of-bounds read with crafted checksum block [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2519716 [ 7 ] Bug #2520136 - CVE-2026-70456 rsync: rsync: Heap Out-of-Bounds Write via crafted argument list [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2520136 [ 8 ] Bug #2520159 - CVE-2026-70455 rsync: rsync: Denial of Service via Zstandard compression thread exhaustion [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2520159 [ 9 ] Bug #2520166 - CVE-2026-70461 rsync: rsync: Information disclosure and denial of service via crafted files-from entry [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2520166 [ 10 ] Bug #2520173 - CVE-2026-53783 rsync: rsync: Directory escape via TOCTOU race condition in rrsync [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2520173 [ 11 ] Bug #2520902 - CVE-2026-53791 rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2520902 [ 12 ] Bug #2520929 - CVE-2026-53790 rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2520929 [ 13 ] Bug #2520943 - CVE-2026-70452 rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2520943 [ 14 ] Bug #2520948 - CVE-2026-53795 rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2520948 [ 15 ] Bug #2520951 - CVE-2026-53794 rsync: rsync: Denial of Service via --max-alloc=0 logic error [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2520951 [ 16 ] Bug #2521032 - CVE-2026-70462 rsync: rsync: Denial of Service via signed integer overflow in I/O timeout [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2521032 [ 17 ] Bug #2521042 - CVE-2026-53793 rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2521042 [ 18 ] Bug #2521726 - CVE-2026-70460 rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2521726 [ 19 ] Bug #2521740 - CVE-2026-70458 rsync: rsync: Memory corruption via crafted file entries [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2521740 [ 20 ] Bug #2521769 - CVE-2026-70464 rsync: rsync: Denial of Service via handshake stall [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2521769 [ 21 ] Bug #2521799 - CVE-2026-53784 rsync: rsync: Unauthorized File Access via Symlink Module Root [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2521799 [ 22 ] Bug #2521808 - CVE-2026-70463 rsync: rsync: Authorization bypass via `auth users` directive parsing [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2521808 [ 23 ] Bug #2521900 - CVE-2026-70454 rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2521900 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-d6763b4c84' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgr... All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- package-announce@lists.fedoraproject.org To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-cond... List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/package-ann... Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new