From e3a73df08ca7ecc0833af64d66ec12d98ea12a29 Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Mon, 7 Sep 2026 15:55:01 +0000 Subject: [PATCH 1/2] Patch rsync for CVE-2026-18743 --- SPECS/rsync/CVE-2026-18743.patch | 46 ++++++++++++++++++++++++++++++++ SPECS/rsync/rsync.spec | 6 ++++- 2 files changed, 51 insertions(+), 1 deletion(-) create mode 100644 SPECS/rsync/CVE-2026-18743.patch diff --git a/SPECS/rsync/CVE-2026-18743.patch b/SPECS/rsync/CVE-2026-18743.patch new file mode 100644 index 00000000000..303959c96b0 --- /dev/null +++ b/SPECS/rsync/CVE-2026-18743.patch @@ -0,0 +1,46 @@ +From 5886aff37d06258a4e1e13d6d16f456c65923fee Mon Sep 17 00:00:00 2001 +From: AllSpark +Date: Mon, 7 Sep 2026 15:49:07 +0000 +Subject: [PATCH] Fix CVE-2026-18743: buffer overflow(s) in + poptConfigFileToString() + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: AI Backport of https://github.com/rpm-software-management/popt/pull/137.patch +--- + popt/poptparse.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/popt/poptparse.c b/popt/poptparse.c +index 5afc6c5..824dc6c 100644 +--- a/popt/poptparse.c ++++ b/popt/poptparse.c +@@ -139,7 +139,7 @@ int poptConfigFileToString(FILE *fp, char ** argstrp, + char * p; + char * q; + char * x; +- size_t t; ++ + size_t argvlen = 0; + size_t maxlinelen = sizeof(line); + size_t linelen; +@@ -186,7 +186,7 @@ int poptConfigFileToString(FILE *fp, char ** argstrp, + if (*q == '\0') { + /* single command line option (ie, no name=val, just name) */ + q[-1] = '\0'; /* kill off newline from fgets() call */ +- argvlen += (t = (size_t)(q - p)) + (sizeof(" --")-1); ++ argvlen += ((size_t)(q - p)) + (sizeof(" --")-1); + if (argvlen >= maxargvlen) { + maxargvlen = (t > maxargvlen) ? t*2 : maxargvlen*2; + argstr_tmp = realloc(argstr, maxargvlen); +@@ -218,7 +218,7 @@ int poptConfigFileToString(FILE *fp, char ** argstrp, + *x = '\0'; /* null out last char if space (including fgets() NL) */ + + /* rest of line accept */ +- t = (size_t)(x - p); ++ + argvlen += t + (sizeof("' --='")-1); + if (argvlen >= maxargvlen) { + maxargvlen = (t > maxargvlen) ? t*2 : maxargvlen*2; +-- +2.45.4 + diff --git a/SPECS/rsync/rsync.spec b/SPECS/rsync/rsync.spec index 918b9e16ab5..3946ad261b5 100644 --- a/SPECS/rsync/rsync.spec +++ b/SPECS/rsync/rsync.spec @@ -1,13 +1,14 @@ Summary: Fast incremental file transfer. Name: rsync Version: 3.5.0 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv3+ Vendor: Microsoft Corporation Distribution: Azure Linux Group: Appication/Internet URL: https://rsync.samba.org/ Source0: https://download.samba.org/pub/rsync/src/%{name}-%{version}.tar.gz +Patch0: CVE-2026-18743.patch BuildRequires: lz4-devel BuildRequires: systemd-rpm-macros BuildRequires: zlib-devel @@ -60,6 +61,9 @@ EOF %{_sysconfdir}/rsyncd.conf %changelog +* Mon Sep 07 2026 Azure Linux Security Servicing Account - 3.5.0-2 +- Patch for CVE-2026-18743 + * Fri Aug 14 2026 CBL-Mariner Servicing Account - 3.5.0-1 - Auto-upgrade to 3.5.0 - for CVE-2026-70458, CVE-2026-53789, CVE-2026-70461, CVE-2026-53800, CVE-2026-53803, CVE-2026-53795, CVE-2026-70454, CVE-2026-53797, CVE-2026-53791, CVE-2026-53792, CVE-2026-53801, CVE-2026-70464, CVE-2026-70452, CVE-2026-53793, CVE-2026-70463, CVE-2026-53798, CVE-2026-70455, CVE-2026-53802, CVE-2026-53785, CVE-2026-53796, CVE-2026-53788, CVE-2026-53786, CVE-2026-53783, CVE-2026-70460, CVE-2026-70459, CVE-2026-53790, CVE-2026-53794, CVE-2026-70462, CVE-2026-70456, CVE-2026-70457, CVE-2026-53799, CVE-2026-53784, CVE-2026-70453, CVE-2026-18839, CVE-2026-18739, CVE-2026-41035 From 54790189e037b617f849198979c905830a768a2c Mon Sep 17 00:00:00 2001 From: Durga Jagadeesh Palli Date: Wed, 9 Sep 2026 06:34:22 +0000 Subject: [PATCH 2/2] Fix incomplete CVE-2026-18743 backport: correct both realloc paths and add -p1 to autosetup --- SPECS/rsync/CVE-2026-18743.patch | 29 +++++++++++++++++------------ SPECS/rsync/rsync.spec | 2 +- 2 files changed, 18 insertions(+), 13 deletions(-) diff --git a/SPECS/rsync/CVE-2026-18743.patch b/SPECS/rsync/CVE-2026-18743.patch index 303959c96b0..3e34b1cbe75 100644 --- a/SPECS/rsync/CVE-2026-18743.patch +++ b/SPECS/rsync/CVE-2026-18743.patch @@ -7,40 +7,45 @@ Subject: [PATCH] Fix CVE-2026-18743: buffer overflow(s) in Signed-off-by: Azure Linux Security Servicing Account Upstream-reference: AI Backport of https://github.com/rpm-software-management/popt/pull/137.patch --- - popt/poptparse.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) + popt/poptparse.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/popt/poptparse.c b/popt/poptparse.c -index 5afc6c5..824dc6c 100644 +index 5afc6c5..6cb5b56 100644 --- a/popt/poptparse.c +++ b/popt/poptparse.c -@@ -139,7 +139,7 @@ int poptConfigFileToString(FILE *fp, char ** argstrp, +@@ -139,7 +139,6 @@ char * p; char * q; char * x; - size_t t; -+ size_t argvlen = 0; size_t maxlinelen = sizeof(line); size_t linelen; -@@ -186,7 +186,7 @@ int poptConfigFileToString(FILE *fp, char ** argstrp, +@@ -186,9 +185,9 @@ if (*q == '\0') { /* single command line option (ie, no name=val, just name) */ q[-1] = '\0'; /* kill off newline from fgets() call */ - argvlen += (t = (size_t)(q - p)) + (sizeof(" --")-1); + argvlen += ((size_t)(q - p)) + (sizeof(" --")-1); if (argvlen >= maxargvlen) { - maxargvlen = (t > maxargvlen) ? t*2 : maxargvlen*2; +- maxargvlen = (t > maxargvlen) ? t*2 : maxargvlen*2; ++ maxargvlen = argvlen * 2; argstr_tmp = realloc(argstr, maxargvlen); -@@ -218,7 +218,7 @@ int poptConfigFileToString(FILE *fp, char ** argstrp, + if (argstr_tmp == NULL) { + free(argstr); +@@ -218,10 +217,9 @@ *x = '\0'; /* null out last char if space (including fgets() NL) */ /* rest of line accept */ - t = (size_t)(x - p); -+ - argvlen += t + (sizeof("' --='")-1); +- argvlen += t + (sizeof("' --='")-1); ++ argvlen += ((size_t)(x - p) + sizeof("' --='")-1); if (argvlen >= maxargvlen) { - maxargvlen = (t > maxargvlen) ? t*2 : maxargvlen*2; +- maxargvlen = (t > maxargvlen) ? t*2 : maxargvlen*2; ++ maxargvlen = argvlen * 2; + argstr_tmp = realloc(argstr, maxargvlen); + if (argstr_tmp == NULL) { + free(argstr); -- 2.45.4 - diff --git a/SPECS/rsync/rsync.spec b/SPECS/rsync/rsync.spec index 3946ad261b5..7ce7be94891 100644 --- a/SPECS/rsync/rsync.spec +++ b/SPECS/rsync/rsync.spec @@ -19,7 +19,7 @@ Requires: zlib Rsync is a fast and extraordinarily versatile file copying tool. It can copy locally, to/from another host over any remote shell, or to/from a remote rsync daemon. It offers a large number of options that control every aspect of its behavior and permit very flexible specification of the set of files to be copied. It is famous for its delta-transfer algorithm, which reduces the amount of data sent over the network by sending only the differences between the source files and the existing files in the destination. Rsync is widely used for backups and mirroring and as an improved copy command for everyday use. %prep -%autosetup +%autosetup -p1 %build %configure --with-included-zlib=no --disable-xxhash