Re: [OE-core][scarthgap][PATCH 1/6] rsync: Fix CVE-2026-29518

["Yoann Congal" <yoann.congal@smile.fr>]

On Mon Jun 22, 2026 at 1:31 PM CEST, Yoann Congal wrote:
> On Fri Jun 12, 2026 at 2:13 PM CEST, Ashishkumar Parmar X (asparmar - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
>> From: Ashishkumar Parmar <asparmar@cisco.com>
>>
>> Pick the upstream backport [1] for CVE-2026-29518 as mentioned in [3],
>> where a non-chrooted rsync daemon could be exposed to a parent path
>> TOCTOU race that allowed file access outside the module.
>>
>> Also include the dependent upstream fix that followed the CVE fix:
>> - CVE-2026-29518_p2.patch [2] secures sender read-path opens by
>>   opening files from the module root, closing the same race on the
>>   read side.
>>
>> [1] https://github.com/RsyncProject/rsync/commit/1a5ad81add1004354a3d8ba841b94ffe19cd2505
>> [2] https://github.com/RsyncProject/rsync/commit/99b36291d06ca66229942c7a525a1f5566f10c85
>> [3] https://www.cve.org/CVERecord?id=CVE-2026-29518
>>
>> Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
>> ---
>
> Hello,
>
> It looks like this whole series is needed for wrynose (rsync 3.4.1).
> Can you send fixes there first, and, then, ping here?

Hello Ashishkumar,

Gentle ping for this patch series. Do you plan to send the needed
wrynose series?

Regards,

>
> Thanks!
>
>>  .../rsync/files/CVE-2026-29518_p1.patch       | 330 ++++++++++++++++++
>>  .../rsync/files/CVE-2026-29518_p2.patch       |  73 ++++
>>  meta/recipes-devtools/rsync/rsync_3.2.7.bb    |   2 +
>>  3 files changed, 405 insertions(+)
>>  create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-29518_p1.patch
>>  create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-29518_p2.patch

-- 
Yoann Congal
Smile ECS