Re: [OE-core][wrynose 11/36] rsync: Fix CVE-2026-45232

["Yoann Congal" <yoann.congal@smile.fr>]

On Tue Jul 28, 2026 at 12:55 AM CEST, Yoann Congal wrote:
> From: Ashishkumar Parmar <asparmar@cisco.com>
>
> This patch applies the upstream v3.4.3 backport for
> CVE-2026-45232. The upstream fix commit is referenced in [1],
> and the public CVE advisory is referenced in [2].
>
> [1] https://github.com/RsyncProject/rsync/commit/a5fc5ebe7a8ef1aa72f6e344599f97fd4427ecba
> [2] https://github.com/RsyncProject/rsync/security/advisories/GHSA-8f85-j2cv-59m8
>
> Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
> ---
>  .../rsync/files/CVE-2026-45232.patch          | 240 ++++++++++++++++++
>  meta/recipes-devtools/rsync/rsync_3.4.1.bb    |   1 +
>  2 files changed, 241 insertions(+)
>  create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-45232.patch

This rsync series does not build on debian11:
|[yocon@debian11 build]$ bitbake rsync-native
|Build Configuration:
|BB_VERSION           = "2.18.0"
|BUILD_SYS            = "x86_64-linux"
|NATIVELSBSTRING      = "universal"
|TARGET_SYS           = "x86_64-poky-linux"
|MACHINE              = "qemux86-64"
|SDKMACHINE           = "x86_64"
|DISTRO               = "poky"
|DISTRO_VERSION       = "6.0.2"
|TUNE_FEATURES        = "m64 x86-64-v3"
|meta                 = "stable/wrynose-nut:d174aa123d5a3e7dab771a060b2d173192e11535"
|meta-yocto-bsp
|meta-poky            = "stable/wrynose-nut:cc2e16655b852958a7bb0ef636e9286b91bcb43f"
|workspace            = "<unknown>:<unknown>"
|
|Sstate summary: Wanted 71 Local 64 Mirrors 0 Missed 7 Current 20 (90% match, 92% complete)
|Initialising tasks: 100% |#####################################################################################################################################################| Time: 0:00:00
|NOTE: Executing Tasks
|ERROR: rsync-native-3.4.1-r0 do_configure: configure failed
|ERROR: rsync-native-3.4.1-r0 do_configure: Execution of '.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/temp/run.do_configure.1808145' failed with exit code 1
|ERROR: Logfile of failure stored in: .../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/temp/log.do_configure.1808145
|Log data follows:
|| DEBUG: Executing python function extend_recipe_sysroot
|| NOTE: Direct dependencies are ['.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-devtools/libtool/libtool-native_2.5.4.bb:do_populate_sysroot', '.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-devtools/quilt/quilt-native_0.69.bb:do_populate_sysroot', 'virtual:native:.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-core/zlib/zlib_1.3.2.bb:do_populate_sysroot', 'virtual:native:.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-devtools/autoconf/autoconf_2.73.bb:do_populate_sysroot', 'virtual:native:.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-devtools/automake/automake_1.18.1.bb:do_populate_sysroot', 'virtual:native:.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-support/attr/acl_2.3.2.bb:do_populate_sysroot', 'virtual:native:.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-support/attr/attr_2.5.2.bb:do_populate_sysroot', 'virtual:native:.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-support/popt/popt_1.19.bb:do_populate_sysroot']
|| NOTE: Installed into sysroot: []
|| NOTE: Skipping as already exists in sysroot: ['gettext-minimal-native', 'libtool-native', 'm4-native', 'quilt-native', 'texinfo-dummy-native', 'zlib-native', 'autoconf-native', 'automake-native', 'gnu-config-native', 'acl-native', 'attr-native', 'popt-native']
|| DEBUG: Python function extend_recipe_sysroot finished
|| DEBUG: Executing shell function autotools_preconfigure
|| DEBUG: Shell function autotools_preconfigure finished
|| DEBUG: Executing python function autotools_sitefiles
|| DEBUG: SITE files ['endian-little', 'common-linux', 'common-glibc', 'bit-64', 'x86_64-linux', 'common']
|| DEBUG: Python function autotools_sitefiles finished
|| DEBUG: Executing shell function do_configure
|| NOTE: Executing ACLOCAL="aclocal --aclocal-path=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/share/aclocal/" autoreconf -Wcross --verbose --install --force --exclude=autopoint
|| autoreconf: export WARNINGS=cross,no-obsolete
|| autoreconf: Entering directory '.'
|| autoreconf: configure.ac: not running autopoint: --exclude autopoint was given
|| autoreconf: running: aclocal --aclocal-path=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/share/aclocal/ --force
|| autoreconf: configure.ac: tracing
|| autoreconf: configure.ac: not using Libtool
|| autoreconf: configure.ac: not using Intltool
|| autoreconf: configure.ac: not using Gtkdoc
|| autoreconf: configure.ac: no need to run autopoint (confirmed)
|| autoreconf: running: .../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/bin/autoconf --force
|| configure.ac:287: warning: AC_RUN_IFELSE called without default to allow cross compiling
|| ../sources/autoconf-2.73/lib/autoconf/general.m4:3037: AC_RUN_IFELSE is expanded from...
|| configure.ac:287: the top level
|| autoreconf: running: .../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/bin/autoheader --force
|| autoreconf: configure.ac: not using Automake
|| autoreconf: './config.sub' is updated
|| autoreconf: './config.guess' is updated
|| autoreconf: './install-sh' is updated
|| autoreconf: configure.ac: not running make: --make not given
|| autoreconf: Leaving directory '.'
|| NOTE: Running ./configure  --build=x86_64-linux 		  --host=x86_64-linux 		  --target=x86_64-linux 		  --prefix=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr 		  --exec_prefix=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr 		  --bindir=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/bin 		  --sbindir=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/sbin 		  --libexecdir=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/libexec 		  --datadir=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/share 		  --sysconfdir=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/etc 		  --sharedstatedir=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/com 		  --localstatedir=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/var 		  --libdir=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/lib 		  --includedir=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/include 		  --oldincludedir=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/include 		  --infodir=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/share/info 		  --mandir=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/share/man 		  --disable-silent-rules 		  --disable-dependency-tracking --disable-md2man --with-nobody-group=nogroup --without-included-zlib --disable-static  --enable-acl-support --enable-xattr-support --enable-ipv6 --disable-lz4 --disable-openssl --disable-xxhash --disable-zstd
|| configure: WARNING: unrecognized options: --disable-silent-rules, --disable-dependency-tracking, --disable-static
|| configure: loading site script .../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/site/endian-little
|| configure: loading site script .../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/site/common-linux
|| configure: loading site script .../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/site/common-glibc
|| configure: loading site script .../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/site/x86_64-linux
|| configure: loading site script .../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/site/common
|| checking for x86_64-linux-gcc... gcc
|| checking whether the C compiler works... no
|| configure: error: in '.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/sources/rsync-3.4.1':
|| configure: error: C compiler cannot create executables
|| See 'config.log' for more details
|| NOTE: The following config.log files may provide further information.
|| NOTE: .../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/sources/rsync-3.4.1/config.log
|| ERROR: configure failed
|| WARNING: exit code 1 from a shell command.
|ERROR: Task (virtual:native:.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-devtools/rsync/rsync_3.4.1.bb:do_configure) failed with exit code '1'
|NOTE: Tasks Summary: Attempted 189 tasks of which 168 didn't need to be rerun and 1 failed.
|
|Summary: 1 task failed:
|  virtual:native:.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-devtools/rsync/rsync_3.4.1.bb:do_configure
|    log: .../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/temp/log.do_configure.1808145
|Summary: There were 2 ERROR messages, returning a non-zero exit code.

The config.log shows:
|/usr/bin/ld: unrecognized option '--no-rosegment'
|/usr/bin/ld: use the --help option for usage information
|collect2: error: ld returned 1 exit status

Ashishkumar, can you look into that?

Thanks!
-- 
Yoann Congal
Smile ECS