Re: [OE-core][wrynose][patch] rsync: Security fixes from v3.4.1-sec-patches3

["Yoann Congal" <yoann.congal@smile.fr>]

On Thu Sep 17, 2026 at 1:38 PM CEST, Yoann Congal wrote:
> On Thu Sep 17, 2026 at 12:55 PM CEST, Vijay Anusuri via lists.openembedded.org wrote:
>> Backport the security fixes from the upstream v3.4.1-sec-patches3
>> branch to address the known rsync security vulnerabilities.
>>
>> The v3.4.1-sec-patches3 branch contains 239 commits. The GitHub
>> workflow commits (037, 038, and 160), which only modify
>> .github/workflows files, and the testsuite-only commits (238 and
>> 239) are excluded because they are not applicable to the Yocto
>> build.
>>
>> The remaining 237 security fixes are combined into a single patch
>> series and applied on top of the rsync 3.4.1 source.
>>
>> SUSE has also backported these security fixes to rsync-3.4.1-160000.6.1
>> to address the corresponding CVEs.
>>
>> References:
>>
>> https://rsync.samba.org/security.html
>> https://github.com/RsyncProject/rsync/tree/v3.4.1-sec-patches3
>> https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-53802
>>
>> This fix handles CVE-2025-10158 CVE-2026-29518 CVE-2026-43617 CVE-2026-43618 CVE-2026-43619 CVE-2026-43620 CVE-2026-45232 CVE-2026-44507 CVE-2026-44508 CVE-2026-44509 CVE-2026-44510 CVE-2026-53783 CVE-2026-53784 CVE-2026-53785 CVE-2026-53786 CVE-2026-53788 CVE-2026-53789 CVE-2026-53790 CVE-2026-53791 CVE-2026-53792 CVE-2026-53793 CVE-2026-53794 CVE-2026-53795 CVE-2026-53796 CVE-2026-53797 CVE-2026-53798 CVE-2026-53799 CVE-2026-53800 CVE-2026-53801 CVE-2026-53802 CVE-2026-53803 CVE-2026-70452 CVE-2026-70453 CVE-2026-70454 CVE-2026-70455 CVE-2026-70456 CVE-2026-70457 CVE-2026-70458 CVE-2026-70459 CVE-2026-70460 CVE-2026-70461 CVE-2026-70462 CVE-2026-70463 CVE-2026-70464
>>
>> Dropped CVE-2025-10158.patch
>> Refreshed the patch 0001-Add-missing-prototypes-to-function-declarations.patch
>>
>> Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
>> ---
>>  ...-prototypes-to-function-declarations.patch |    81 +-
>>  .../rsync/files/CVE-2025-10158.patch          |    36 -
>>  .../files/rsync-3.4.1-sec-patches3.patch      | 34052 ++++++++++++++++
>>  meta/recipes-devtools/rsync/rsync_3.4.1.bb    |     2 +-
>>  4 files changed, 34071 insertions(+), 100 deletions(-)
>>  delete mode 100644 meta/recipes-devtools/rsync/files/CVE-2025-10158.patch
>>  create mode 100644 meta/recipes-devtools/rsync/files/rsync-3.4.1-sec-patches3.patch
>
> Hello,
>
> I don't think I want to carry a 34000 lines patch.
>
> Does the rsync project released a v3.4.1-sec-patches3 archive?
>
> If not, can we try to switch the recipe to git and point SRCREV to the
> "rsync-3.4.1-sec-patches" branch?
> Since the recipe is not git-based now, we'll need to switch to git
> first, then upgrade.

Paul asked a good question about this idea though: How official is this
branch?
Can you ask upstream the status of it? Will it stay published? Will we
see v3.4.1-sec-patches4,5... branches someday?

Thanks!
-- 
Yoann Congal
Smile ECS