On Fri Jun 12, 2026 at 2:13 PM CEST, Ashishkumar Parmar X (asparmar - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote: > From: Ashishkumar Parmar <[email protected]> > > Pick the upstream backport [1] for CVE-2026-29518 as mentioned in [3], > where a non-chrooted rsync daemon could be exposed to a parent path > TOCTOU race that allowed file access outside the module. > > Also include the dependent upstream fix that followed the CVE fix: > - CVE-2026-29518_p2.patch [2] secures sender read-path opens by > opening files from the module root, closing the same race on the > read side. > > [1] > https://github.com/RsyncProject/rsync/commit/1a5ad81add1004354a3d8ba841b94ffe19cd2505 > [2] > https://github.com/RsyncProject/rsync/commit/99b36291d06ca66229942c7a525a1f5566f10c85 > [3] https://www.cve.org/CVERecord?id=CVE-2026-29518 > > Signed-off-by: Ashishkumar Parmar <[email protected]> > --- > .../rsync/files/CVE-2026-29518_p1.patch | 330 ++++++++++++++++++ > .../rsync/files/CVE-2026-29518_p2.patch | 73 ++++ > meta/recipes-devtools/rsync/rsync_3.2.7.bb | 2 + > 3 files changed, 405 insertions(+) > create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-29518_p1.patch > create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-29518_p2.patch
The backported commit[1] is from a branch called "v3.2.7-sec-patches" with a tag "v3.2.7-sec-patches1". If upstream has a branch looking like a stable branch, shouldn't we try to upgrade on this branch? Can you look if a "v3.2.7 -> v3.2.7-sec-patches1 upgrade" would be possible on scarthgap? Thanks, -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#242107): https://lists.openembedded.org/g/openembedded-core/message/242107 Mute This Topic: https://lists.openembedded.org/mt/119772227/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
