Skip to content

GHSA-pfj8-79vq-xgvr on CTRL-OS 26.05

Aliases: GHSA-pfj8-79vq-xgvr, CVE-2026-70463

Packages: rsync

Status: Plausible

Advisory Information

rsyncd.conf(5) documents that if the auth users value starts with a comma, splitting is performed on commas ALONE, so that an NSS group name containing a space can be expressed:

auth users = ,@Group Name:deny, alice:rw

auth_server() ignored the leading comma and always tokenised on commas AND whitespace (strtok(users, " ,\t")). @Group Name:deny therefore split into @Group -- which matches only a group literally named "Group", so the intended deny never fires -- and Name:deny, treated as a username.

auth users is first-match, so the rule the administrator wrote to deny (or restrict to :ro) a group is skipped and a later :rw entry matches instead. A member of the group the administrator intended to exclude is granted the access the configuration says they must not have. The failure is silent: the configuration parses without error and looks correct.

Fixed by parsing the value with conf_strtok() so a leading comma selects comma-only splitting as documented.

Affected: 3.1.0 through 3.4.4 (@group support in auth users entered in 3.1.0)

Fixed in: 3.5.0

Reporter: Andres Berbescu

Test: daemon-auth-users-comma-only

Updates

2026-08-14 16:57 CEST

Metadata changes:

  • Status for package rsync: “Plausible”

2026-08-14 16:55 CEST

Metadata changes:

  • Status for package rsync: “New”