rhba-2025:6470
Vulnerability from csaf_redhat
Published
2025-05-13 08:18
Modified
2025-07-29 09:55
Summary
Red Hat Bug Fix Advisory: rsync bug fix and enhancement update
Notes
Topic
An update for rsync is now available for Red Hat Enterprise Linux 10.
Details
For detailed information on changes in this release, see the Red Hat Enterprise Linux 10 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for rsync is now available for Red Hat Enterprise Linux 10.",
"title": "Topic"
},
{
"category": "general",
"text": "For detailed information on changes in this release, see the Red Hat Enterprise Linux 10 Release Notes linked from the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHBA-2025:6470",
"url": "https://access.redhat.com/errata/RHBA-2025:6470"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.0_release_notes/index",
"url": "https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.0_release_notes/index"
},
{
"category": "external",
"summary": "RHEL-71293",
"url": "https://issues.redhat.com/browse/RHEL-71293"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2025_6470.json"
}
],
"title": "Red Hat Bug Fix Advisory: rsync bug fix and enhancement update",
"tracking": {
"current_release_date": "2025-07-29T09:55:04+00:00",
"generator": {
"date": "2025-07-29T09:55:04+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.5"
}
},
"id": "RHBA-2025:6470",
"initial_release_date": "2025-05-13T08:18:15+00:00",
"revision_history": [
{
"date": "2025-05-13T08:18:15+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-05-13T08:18:15+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-07-29T09:55:04+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.GA",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.0"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux BaseOS (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.0.GA",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.4.1-2.el10.src",
"product": {
"name": "rsync-0:3.4.1-2.el10.src",
"product_id": "rsync-0:3.4.1-2.el10.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.4.1-2.el10?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.4.1-2.el10.aarch64",
"product": {
"name": "rsync-0:3.4.1-2.el10.aarch64",
"product_id": "rsync-0:3.4.1-2.el10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.4.1-2.el10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "rsync-debugsource-0:3.4.1-2.el10.aarch64",
"product": {
"name": "rsync-debugsource-0:3.4.1-2.el10.aarch64",
"product_id": "rsync-debugsource-0:3.4.1-2.el10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debugsource@3.4.1-2.el10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "rsync-debuginfo-0:3.4.1-2.el10.aarch64",
"product": {
"name": "rsync-debuginfo-0:3.4.1-2.el10.aarch64",
"product_id": "rsync-debuginfo-0:3.4.1-2.el10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debuginfo@3.4.1-2.el10?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.4.1-2.el10.ppc64le",
"product": {
"name": "rsync-0:3.4.1-2.el10.ppc64le",
"product_id": "rsync-0:3.4.1-2.el10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.4.1-2.el10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "rsync-debugsource-0:3.4.1-2.el10.ppc64le",
"product": {
"name": "rsync-debugsource-0:3.4.1-2.el10.ppc64le",
"product_id": "rsync-debugsource-0:3.4.1-2.el10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debugsource@3.4.1-2.el10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "rsync-debuginfo-0:3.4.1-2.el10.ppc64le",
"product": {
"name": "rsync-debuginfo-0:3.4.1-2.el10.ppc64le",
"product_id": "rsync-debuginfo-0:3.4.1-2.el10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debuginfo@3.4.1-2.el10?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.4.1-2.el10.x86_64",
"product": {
"name": "rsync-0:3.4.1-2.el10.x86_64",
"product_id": "rsync-0:3.4.1-2.el10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.4.1-2.el10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rsync-debugsource-0:3.4.1-2.el10.x86_64",
"product": {
"name": "rsync-debugsource-0:3.4.1-2.el10.x86_64",
"product_id": "rsync-debugsource-0:3.4.1-2.el10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debugsource@3.4.1-2.el10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rsync-debuginfo-0:3.4.1-2.el10.x86_64",
"product": {
"name": "rsync-debuginfo-0:3.4.1-2.el10.x86_64",
"product_id": "rsync-debuginfo-0:3.4.1-2.el10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debuginfo@3.4.1-2.el10?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.4.1-2.el10.s390x",
"product": {
"name": "rsync-0:3.4.1-2.el10.s390x",
"product_id": "rsync-0:3.4.1-2.el10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.4.1-2.el10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "rsync-debugsource-0:3.4.1-2.el10.s390x",
"product": {
"name": "rsync-debugsource-0:3.4.1-2.el10.s390x",
"product_id": "rsync-debugsource-0:3.4.1-2.el10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debugsource@3.4.1-2.el10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "rsync-debuginfo-0:3.4.1-2.el10.s390x",
"product": {
"name": "rsync-debuginfo-0:3.4.1-2.el10.s390x",
"product_id": "rsync-debuginfo-0:3.4.1-2.el10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debuginfo@3.4.1-2.el10?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-daemon-0:3.4.1-2.el10.noarch",
"product": {
"name": "rsync-daemon-0:3.4.1-2.el10.noarch",
"product_id": "rsync-daemon-0:3.4.1-2.el10.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-daemon@3.4.1-2.el10?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rsync-rrsync-0:3.4.1-2.el10.noarch",
"product": {
"name": "rsync-rrsync-0:3.4.1-2.el10.noarch",
"product_id": "rsync-rrsync-0:3.4.1-2.el10.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-rrsync@3.4.1-2.el10?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.4.1-2.el10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.GA:rsync-0:3.4.1-2.el10.aarch64"
},
"product_reference": "rsync-0:3.4.1-2.el10.aarch64",
"relates_to_product_reference": "AppStream-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.4.1-2.el10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.GA:rsync-0:3.4.1-2.el10.ppc64le"
},
"product_reference": "rsync-0:3.4.1-2.el10.ppc64le",
"relates_to_product_reference": "AppStream-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.4.1-2.el10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.GA:rsync-0:3.4.1-2.el10.s390x"
},
"product_reference": "rsync-0:3.4.1-2.el10.s390x",
"relates_to_product_reference": "AppStream-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.4.1-2.el10.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.GA:rsync-0:3.4.1-2.el10.src"
},
"product_reference": "rsync-0:3.4.1-2.el10.src",
"relates_to_product_reference": "AppStream-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.4.1-2.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.GA:rsync-0:3.4.1-2.el10.x86_64"
},
"product_reference": "rsync-0:3.4.1-2.el10.x86_64",
"relates_to_product_reference": "AppStream-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-daemon-0:3.4.1-2.el10.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.GA:rsync-daemon-0:3.4.1-2.el10.noarch"
},
"product_reference": "rsync-daemon-0:3.4.1-2.el10.noarch",
"relates_to_product_reference": "AppStream-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.4.1-2.el10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.aarch64"
},
"product_reference": "rsync-debuginfo-0:3.4.1-2.el10.aarch64",
"relates_to_product_reference": "AppStream-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.4.1-2.el10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.ppc64le"
},
"product_reference": "rsync-debuginfo-0:3.4.1-2.el10.ppc64le",
"relates_to_product_reference": "AppStream-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.4.1-2.el10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.s390x"
},
"product_reference": "rsync-debuginfo-0:3.4.1-2.el10.s390x",
"relates_to_product_reference": "AppStream-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.4.1-2.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.x86_64"
},
"product_reference": "rsync-debuginfo-0:3.4.1-2.el10.x86_64",
"relates_to_product_reference": "AppStream-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.4.1-2.el10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.aarch64"
},
"product_reference": "rsync-debugsource-0:3.4.1-2.el10.aarch64",
"relates_to_product_reference": "AppStream-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.4.1-2.el10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.ppc64le"
},
"product_reference": "rsync-debugsource-0:3.4.1-2.el10.ppc64le",
"relates_to_product_reference": "AppStream-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.4.1-2.el10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.s390x"
},
"product_reference": "rsync-debugsource-0:3.4.1-2.el10.s390x",
"relates_to_product_reference": "AppStream-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.4.1-2.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.x86_64"
},
"product_reference": "rsync-debugsource-0:3.4.1-2.el10.x86_64",
"relates_to_product_reference": "AppStream-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-rrsync-0:3.4.1-2.el10.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.GA:rsync-rrsync-0:3.4.1-2.el10.noarch"
},
"product_reference": "rsync-rrsync-0:3.4.1-2.el10.noarch",
"relates_to_product_reference": "AppStream-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.4.1-2.el10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.aarch64"
},
"product_reference": "rsync-0:3.4.1-2.el10.aarch64",
"relates_to_product_reference": "BaseOS-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.4.1-2.el10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.ppc64le"
},
"product_reference": "rsync-0:3.4.1-2.el10.ppc64le",
"relates_to_product_reference": "BaseOS-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.4.1-2.el10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.s390x"
},
"product_reference": "rsync-0:3.4.1-2.el10.s390x",
"relates_to_product_reference": "BaseOS-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.4.1-2.el10.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.src"
},
"product_reference": "rsync-0:3.4.1-2.el10.src",
"relates_to_product_reference": "BaseOS-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.4.1-2.el10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.x86_64"
},
"product_reference": "rsync-0:3.4.1-2.el10.x86_64",
"relates_to_product_reference": "BaseOS-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-daemon-0:3.4.1-2.el10.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.0.GA:rsync-daemon-0:3.4.1-2.el10.noarch"
},
"product_reference": "rsync-daemon-0:3.4.1-2.el10.noarch",
"relates_to_product_reference": "BaseOS-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.4.1-2.el10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.aarch64"
},
"product_reference": "rsync-debuginfo-0:3.4.1-2.el10.aarch64",
"relates_to_product_reference": "BaseOS-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.4.1-2.el10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.ppc64le"
},
"product_reference": "rsync-debuginfo-0:3.4.1-2.el10.ppc64le",
"relates_to_product_reference": "BaseOS-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.4.1-2.el10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.s390x"
},
"product_reference": "rsync-debuginfo-0:3.4.1-2.el10.s390x",
"relates_to_product_reference": "BaseOS-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.4.1-2.el10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.x86_64"
},
"product_reference": "rsync-debuginfo-0:3.4.1-2.el10.x86_64",
"relates_to_product_reference": "BaseOS-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.4.1-2.el10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.aarch64"
},
"product_reference": "rsync-debugsource-0:3.4.1-2.el10.aarch64",
"relates_to_product_reference": "BaseOS-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.4.1-2.el10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.ppc64le"
},
"product_reference": "rsync-debugsource-0:3.4.1-2.el10.ppc64le",
"relates_to_product_reference": "BaseOS-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.4.1-2.el10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.s390x"
},
"product_reference": "rsync-debugsource-0:3.4.1-2.el10.s390x",
"relates_to_product_reference": "BaseOS-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.4.1-2.el10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.x86_64"
},
"product_reference": "rsync-debugsource-0:3.4.1-2.el10.x86_64",
"relates_to_product_reference": "BaseOS-10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-rrsync-0:3.4.1-2.el10.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.0.GA:rsync-rrsync-0:3.4.1-2.el10.noarch"
},
"product_reference": "rsync-rrsync-0:3.4.1-2.el10.noarch",
"relates_to_product_reference": "BaseOS-10.0.GA"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Simon Scannell",
"Pedro Gallegos",
"Jasiel Spelman"
],
"organization": "Google"
}
],
"cve": "CVE-2024-12084",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2024-12-05T09:32:44.653000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2330527"
}
],
"notes": [
{
"category": "description",
"text": "A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: Heap Buffer Overflow in Rsync due to Improper Checksum Length Handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability only affects a limited range of Rsync versions, rsync-3.2.7 and rsync-3.3.0. Red Hat Enterprise Linux does not ship these versions of Rsync and is not affected.\n\nRed Hat considers the severity of this vulnerability to be Critical only in cases where anonymous read access is allowed. Depending on the configuration and implementation choices, the severity may be significantly reduced for your organization.\n\nIn all supported versions of Red Hat Enterprise Linux, Rsync is not configured to run as a service by default.\n\nThere are two different methods for utilizing Rsync from a remote system: contacting an Rsync daemon directly with TCP or using a remote-shell program as the transport (such as ssh or rsh). The risk of this vulnerability changes depending on which connection method is used.\n\nThe default configuration of an Rsync daemon (rsyncd) running as a service does not require authentication. While rsyncd can be configured to require users to provide valid credentials, anonymous read access is a common configuration used by file sharing and mirroring hosts. The capabilities of the rsyncd process may vary depending on the user configured to run the Rsync daemon. In this scenario, an attacker only requires anonymous read access to a Rsync server in order to trigger this vulnerability. \n\nRemote-shell programs provide a layer of defense because they enforce users to have valid credentials while initiating the shell connection. When Rsync is invoked via this method, it spawns as a child of the session and will not remain running indefinitely. Since the process is spawned within the security context of the user, an attacker who is able to exploit this vulnerability remains restricted to the capabilities of the user account used to initiate the session. Authentication and network restrictions significantly reduce the attack surface and restricting permissions for remote shell users is always encouraged to limit the impact of compromised credentials.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.GA:rsync-0:3.4.1-2.el10.aarch64",
"AppStream-10.0.GA:rsync-0:3.4.1-2.el10.ppc64le",
"AppStream-10.0.GA:rsync-0:3.4.1-2.el10.s390x",
"AppStream-10.0.GA:rsync-0:3.4.1-2.el10.src",
"AppStream-10.0.GA:rsync-0:3.4.1-2.el10.x86_64",
"AppStream-10.0.GA:rsync-daemon-0:3.4.1-2.el10.noarch",
"AppStream-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.aarch64",
"AppStream-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.ppc64le",
"AppStream-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.s390x",
"AppStream-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.x86_64",
"AppStream-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.aarch64",
"AppStream-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.ppc64le",
"AppStream-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.s390x",
"AppStream-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.x86_64",
"AppStream-10.0.GA:rsync-rrsync-0:3.4.1-2.el10.noarch",
"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.aarch64",
"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.ppc64le",
"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.s390x",
"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.src",
"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.x86_64",
"BaseOS-10.0.GA:rsync-daemon-0:3.4.1-2.el10.noarch",
"BaseOS-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.aarch64",
"BaseOS-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.ppc64le",
"BaseOS-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.s390x",
"BaseOS-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.x86_64",
"BaseOS-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.aarch64",
"BaseOS-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.ppc64le",
"BaseOS-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.s390x",
"BaseOS-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.x86_64",
"BaseOS-10.0.GA:rsync-rrsync-0:3.4.1-2.el10.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-12084"
},
{
"category": "external",
"summary": "RHBZ#2330527",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330527"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-12084",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12084"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12084",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12084"
},
{
"category": "external",
"summary": "https://kb.cert.org/vuls/id/952657",
"url": "https://kb.cert.org/vuls/id/952657"
}
],
"release_date": "2025-01-14T15:06:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T08:18:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.GA:rsync-0:3.4.1-2.el10.aarch64",
"AppStream-10.0.GA:rsync-0:3.4.1-2.el10.ppc64le",
"AppStream-10.0.GA:rsync-0:3.4.1-2.el10.s390x",
"AppStream-10.0.GA:rsync-0:3.4.1-2.el10.src",
"AppStream-10.0.GA:rsync-0:3.4.1-2.el10.x86_64",
"AppStream-10.0.GA:rsync-daemon-0:3.4.1-2.el10.noarch",
"AppStream-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.aarch64",
"AppStream-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.ppc64le",
"AppStream-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.s390x",
"AppStream-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.x86_64",
"AppStream-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.aarch64",
"AppStream-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.ppc64le",
"AppStream-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.s390x",
"AppStream-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.x86_64",
"AppStream-10.0.GA:rsync-rrsync-0:3.4.1-2.el10.noarch",
"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.aarch64",
"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.ppc64le",
"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.s390x",
"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.src",
"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.x86_64",
"BaseOS-10.0.GA:rsync-daemon-0:3.4.1-2.el10.noarch",
"BaseOS-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.aarch64",
"BaseOS-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.ppc64le",
"BaseOS-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.s390x",
"BaseOS-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.x86_64",
"BaseOS-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.aarch64",
"BaseOS-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.ppc64le",
"BaseOS-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.s390x",
"BaseOS-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.x86_64",
"BaseOS-10.0.GA:rsync-rrsync-0:3.4.1-2.el10.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2025:6470"
},
{
"category": "workaround",
"details": "Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances.\n\nAdditionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). \n\nSystems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible.",
"product_ids": [
"AppStream-10.0.GA:rsync-0:3.4.1-2.el10.aarch64",
"AppStream-10.0.GA:rsync-0:3.4.1-2.el10.ppc64le",
"AppStream-10.0.GA:rsync-0:3.4.1-2.el10.s390x",
"AppStream-10.0.GA:rsync-0:3.4.1-2.el10.src",
"AppStream-10.0.GA:rsync-0:3.4.1-2.el10.x86_64",
"AppStream-10.0.GA:rsync-daemon-0:3.4.1-2.el10.noarch",
"AppStream-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.aarch64",
"AppStream-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.ppc64le",
"AppStream-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.s390x",
"AppStream-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.x86_64",
"AppStream-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.aarch64",
"AppStream-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.ppc64le",
"AppStream-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.s390x",
"AppStream-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.x86_64",
"AppStream-10.0.GA:rsync-rrsync-0:3.4.1-2.el10.noarch",
"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.aarch64",
"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.ppc64le",
"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.s390x",
"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.src",
"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.x86_64",
"BaseOS-10.0.GA:rsync-daemon-0:3.4.1-2.el10.noarch",
"BaseOS-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.aarch64",
"BaseOS-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.ppc64le",
"BaseOS-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.s390x",
"BaseOS-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.x86_64",
"BaseOS-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.aarch64",
"BaseOS-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.ppc64le",
"BaseOS-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.s390x",
"BaseOS-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.x86_64",
"BaseOS-10.0.GA:rsync-rrsync-0:3.4.1-2.el10.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.GA:rsync-0:3.4.1-2.el10.aarch64",
"AppStream-10.0.GA:rsync-0:3.4.1-2.el10.ppc64le",
"AppStream-10.0.GA:rsync-0:3.4.1-2.el10.s390x",
"AppStream-10.0.GA:rsync-0:3.4.1-2.el10.src",
"AppStream-10.0.GA:rsync-0:3.4.1-2.el10.x86_64",
"AppStream-10.0.GA:rsync-daemon-0:3.4.1-2.el10.noarch",
"AppStream-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.aarch64",
"AppStream-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.ppc64le",
"AppStream-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.s390x",
"AppStream-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.x86_64",
"AppStream-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.aarch64",
"AppStream-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.ppc64le",
"AppStream-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.s390x",
"AppStream-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.x86_64",
"AppStream-10.0.GA:rsync-rrsync-0:3.4.1-2.el10.noarch",
"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.aarch64",
"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.ppc64le",
"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.s390x",
"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.src",
"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.x86_64",
"BaseOS-10.0.GA:rsync-daemon-0:3.4.1-2.el10.noarch",
"BaseOS-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.aarch64",
"BaseOS-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.ppc64le",
"BaseOS-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.s390x",
"BaseOS-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.x86_64",
"BaseOS-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.aarch64",
"BaseOS-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.ppc64le",
"BaseOS-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.s390x",
"BaseOS-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.x86_64",
"BaseOS-10.0.GA:rsync-rrsync-0:3.4.1-2.el10.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "rsync: Heap Buffer Overflow in Rsync due to Improper Checksum Length Handling"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…