Debian Bookworm rsync Update Fixes 34 Flaws and Changes Behavior
Tech GuruQuick Answer
Update Debian bookworm rsync to 3.5.0+ds1-0+deb12u1. Review the Debian NEWS entry first, test backup and transfer jobs against changed path, daemon and TLS behavior, then verify versions and retain restore-test evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Record client and server package versions, scheduled transfers, rsyncd modules, rrsync accounts, backup paths, symlink ownership and TLS wrappers. Match Debian bookworm packages and the source version to DLA-4888-1. Identify workflows relying on legacy symlink following, remote special-file creation, proxy headers or permissive certificate handling. Install the supported bookworm security package and read the Debian package NEWS and linked maintainer guidance. Update configurations to satisfy the new trust and verification rules before resuming unattended jobs. Test normal transfers and representative restore operations, review exit status and logs, verify daemon allow/deny rules and proxy trust, and check rsync-ssl hostname and CA validation. Retain package versions, configuration changes and transfer/restore evidence.
Last verified: 2026-11-09 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | rsync packages on Debian 12 bookworm |
|---|---|
| Advisory | DLA-4888-1 |
| CVEs | CVE-2026-119741, CVE-2026-53783, CVE-2026-53784, CVE-2026-53785, CVE-2026-53786, CVE-2026-53788, CVE-2026-53789, CVE-2026-53790, CVE-2026-53791, CVE-2026-53792, CVE-2026-53793, CVE-2026-53794, CVE-2026-53795, CVE-2026-53796, CVE-2026-53797, CVE-2026-53798, CVE-2026-53799, CVE-2026-53800, CVE-2026-53801, CVE-2026-53802, CVE-2026-53803, CVE-2026-70452, CVE-2026-70453, CVE-2026-70454, CVE-2026-70455, CVE-2026-70456, CVE-2026-70457, CVE-2026-70458, CVE-2026-70459, CVE-2026-70460, CVE-2026-70461, CVE-2026-70462, CVE-2026-70463, CVE-2026-70464 |
| Authoritative release date | November 9, 2026 at 03:09:27 UTC (10:09:27 +0700), from the Debian LTS advisory message. |
| Authority revision date | No later revision is stated for DLA-4888-1. |
| Affected versions | Debian 12 bookworm rsync packages requiring DLA-4888-1. The tracker marks 3.2.7-1+deb12u6 vulnerable and 3.5.0+ds1-0+deb12u1 fixed. |
| Fixed version | rsync 3.5.0+ds1-0+deb12u1 for Debian bookworm |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Debian does not state malicious exploitation in this advisory.; no exploitation claim is inferred. |
What Changed
Debian backported rsync 3.5.0 with regression fixes from 3.5.1 to bookworm for 34 vulnerabilities, rather than individually applying the fixes to 3.2.7. The advisory describes possible privilege escalation, access-control bypass, disclosure, denial of service and code execution, and warns of potentially disruptive behavior changes.
What To Validate Now
- Inventory. Record client and server package versions, scheduled transfers, rsyncd modules, rrsync accounts, backup paths, symlink ownership and TLS wrappers.
- Establish applicability. Match Debian bookworm packages and the source version to DLA-4888-1. Identify workflows relying on legacy symlink following, remote special-file creation, proxy headers or permissive certificate handling.
- Remediate. Install the supported bookworm security package and read the Debian package NEWS and linked maintainer guidance. Update configurations to satisfy the new trust and verification rules before resuming unattended jobs.
- Validate. Test normal transfers and representative restore operations, review exit status and logs, verify daemon allow/deny rules and proxy trust, and check rsync-ssl hostname and CA validation. Retain package versions, configuration changes and transfer/restore evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Paths through symlinks owned by untrusted users can now be rejected. Restricted rrsync, daemon access checks, chmod behavior and TLS verification also change. Explicit proxy protocol hosts and valid CA configuration may be required. Do not enable insecure compatibility options simply to silence failures; assess the affected trust boundary.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
