Skip to content

GHSA-hx7p-3gvv-pqgv on CTRL-OS 26.05

Aliases: GHSA-hx7p-3gvv-pqgv, CVE-2026-53798

Packages: rsync

Status: Plausible

Advisory Information

The name-converter contract returns an empty value for an unknown name, but the daemon read an empty line as success and applied atol("") == 0, so an unknown sender name was mapped to uid/gid 0. With fake super = yes the stored file's metadata then became root-owned (0:0).

Fix: treat an empty/non-numeric converter response as a lookup failure, so unknown names fall back to the sender's numeric id.

Test: daemon-namecvt-empty-response.

Credit: Mitchell Benjamin (Revamp Studio).

Affected: rsync 3.4.3 and earlier; fixed in 3.5.0. (Precise introduced-in ranges being finalised.)

Updates

2026-08-14 16:57 CEST

Metadata changes:

  • Status for package rsync: “Plausible”

2026-08-14 16:55 CEST

Metadata changes:

  • Status for package rsync: “New”