This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] rsync fixes 6 vulnerabilities
rsync version 3.4.0 fixes 6 vulnerabilities, some of which affect the rsync server and some the client [1]. Version 3.4.1 was subsequently released, which fixes some regressions from version 3.4.0 [17]. The vulnerability CVE-2024-12084 (RCE) does not affect instances running an operating system from the Red Hat family [2]; in Debian this vulnerability does not affect only the bullseye release [3], and Ubuntu is vulnerable only in the noble and jammy releases [4]. Individual OS releases and their fixed versions: Debian [3][5][6][7][8][9]: bookworm (security) - 3.2.7-1+deb12u2 sid, trixie - 3.3.0+ds1-4 Ubuntu [4][10][11][12][13][14] - noble - 3.2.7-1ubuntu1.1 jammy - 3.2.7-0ubuntu0.22.04.3 focal - 3.1.3-8ubuntu0.8 bionic - 3.1.2-2.1ubuntu1.6+esm1 xenial - 3.1.1-3ubuntu1.3+esm3 Gentoo - update available for commonly used architectures [15] Red Hat [16]
Allows an unauthenticated remote attacker to potentially execute code by causing a heap overflow [1].
The vulnerability is present in product:
- rsync; > 3.2.7, < 3.4.0;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-12084 at cve.org, NVD
- CWE-122: Heap-based Buffer Overflow at cwe.mitre.org
The vulnerability was publicly disclosed 14. 1. 2025.
Allows an unauthenticated remote attacker to view data from memory without authorization [1].
The vulnerability is present in product:
- rsync; < 3.4.0;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2024-12085 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 14. 1. 2025.
Allows an unauthenticated remote attacker to view files on the disk of the rsync client without authorization [1].
The vulnerability is present in product:
- rsync; <3.4.0;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
More information:
- CVE-2024-12086 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 14. 1. 2025.
Allows an unauthenticated remote attacker, under certain circumstances, to write files to arbitrary locations on the disk of the rsync client [1].
The vulnerability is present in product:
- rsync; <3.4.0;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
More information:
- CVE-2024-12087 at cve.org, NVD
- CVE-2024-12088 at cve.org, NVD
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org
The vulnerability was publicly disclosed 14. 1. 2025.
Allows an authenticated local attacker to view sensitive information, which can potentially lead to privilege escalation [1].
The vulnerability is present in product:
- rsync; <3.4.0;
CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
More information:
- CVE-2024-12747 at cve.org, NVD
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor at cwe.mitre.org
The vulnerability was publicly disclosed 14. 1. 2025.
Links
- [1] https://www.openwall.com/lists/oss-security/2025/01/14/3
- [2] https://access.redhat.com/security/cve/cve-2024-12084
- [3] https://security-tracker.debian.org/tracker/CVE-2024-12084
- [4] https://ubuntu.com/security/CVE-2024-12084
- [5] https://security-tracker.debian.org/tracker/CVE-2024-12085
- [6] https://security-tracker.debian.org/tracker/CVE-2024-12086
- [7] https://security-tracker.debian.org/tracker/CVE-2024-12087
- [8] https://security-tracker.debian.org/tracker/CVE-2024-12088
- [9] https://security-tracker.debian.org/tracker/CVE-2024-12747
- [10] https://ubuntu.com/security/CVE-2024-12085
- [11] https://ubuntu.com/security/CVE-2024-12086
- [12] https://ubuntu.com/security/CVE-2024-12087
- [13] https://ubuntu.com/security/CVE-2024-12088
- [14] https://ubuntu.com/security/CVE-2024-12747
- [15] https://packages.gentoo.org/packages/net-misc/rsync
- [16] https://access.redhat.com/errata/RHSA-2025:0324
- [17] https://download.samba.org/pub/rsync/NEWS#3.4.1
By CESNET, z.s.p.o. Martin Krajči on 17. 1. 2025.