rhsa-2025:2600
Vulnerability from csaf_redhat
Published
2025-03-11 00:23
Modified
2025-08-12 20:38
Summary
Red Hat Security Advisory: rsync security update

Notes

Topic
An update for rsync is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es): * rsync: Path traversal vulnerability in rsync (CVE-2024-12087) * rsync: --safe-links option bypass leads to path traversal (CVE-2024-12088) * rsync: Race Condition in rsync Handling Symbolic Links (CVE-2024-12747) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for rsync is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: Path traversal vulnerability in rsync (CVE-2024-12087)\n\n* rsync: --safe-links option bypass leads to path traversal (CVE-2024-12088)\n\n* rsync: Race Condition in rsync Handling Symbolic Links (CVE-2024-12747)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:2600",
        "url": "https://access.redhat.com/errata/RHSA-2025:2600"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2330672",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330672"
      },
      {
        "category": "external",
        "summary": "2330676",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330676"
      },
      {
        "category": "external",
        "summary": "2332968",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2332968"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2600.json"
      }
    ],
    "title": "Red Hat Security Advisory: rsync security update",
    "tracking": {
      "current_release_date": "2025-08-12T20:38:42+00:00",
      "generator": {
        "date": "2025-08-12T20:38:42+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.6"
        }
      },
      "id": "RHSA-2025:2600",
      "initial_release_date": "2025-03-11T00:23:51+00:00",
      "revision_history": [
        {
          "date": "2025-03-11T00:23:51+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-03-11T00:23:51+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-08-12T20:38:42+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS (v. 8)",
                  "product_id": "BaseOS-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:8::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rsync-0:3.1.3-21.el8_10.src",
                "product": {
                  "name": "rsync-0:3.1.3-21.el8_10.src",
                  "product_id": "rsync-0:3.1.3-21.el8_10.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rsync@3.1.3-21.el8_10?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rsync-0:3.1.3-21.el8_10.aarch64",
                "product": {
                  "name": "rsync-0:3.1.3-21.el8_10.aarch64",
                  "product_id": "rsync-0:3.1.3-21.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rsync@3.1.3-21.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
                "product": {
                  "name": "rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
                  "product_id": "rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rsync-debugsource@3.1.3-21.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
                "product": {
                  "name": "rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
                  "product_id": "rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rsync-debuginfo@3.1.3-21.el8_10?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rsync-0:3.1.3-21.el8_10.ppc64le",
                "product": {
                  "name": "rsync-0:3.1.3-21.el8_10.ppc64le",
                  "product_id": "rsync-0:3.1.3-21.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rsync@3.1.3-21.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
                "product": {
                  "name": "rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
                  "product_id": "rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rsync-debugsource@3.1.3-21.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
                "product": {
                  "name": "rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
                  "product_id": "rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rsync-debuginfo@3.1.3-21.el8_10?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rsync-0:3.1.3-21.el8_10.x86_64",
                "product": {
                  "name": "rsync-0:3.1.3-21.el8_10.x86_64",
                  "product_id": "rsync-0:3.1.3-21.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rsync@3.1.3-21.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
                "product": {
                  "name": "rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
                  "product_id": "rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rsync-debugsource@3.1.3-21.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
                "product": {
                  "name": "rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
                  "product_id": "rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rsync-debuginfo@3.1.3-21.el8_10?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rsync-0:3.1.3-21.el8_10.s390x",
                "product": {
                  "name": "rsync-0:3.1.3-21.el8_10.s390x",
                  "product_id": "rsync-0:3.1.3-21.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rsync@3.1.3-21.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rsync-debugsource-0:3.1.3-21.el8_10.s390x",
                "product": {
                  "name": "rsync-debugsource-0:3.1.3-21.el8_10.s390x",
                  "product_id": "rsync-debugsource-0:3.1.3-21.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rsync-debugsource@3.1.3-21.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
                "product": {
                  "name": "rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
                  "product_id": "rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rsync-debuginfo@3.1.3-21.el8_10?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rsync-daemon-0:3.1.3-21.el8_10.noarch",
                "product": {
                  "name": "rsync-daemon-0:3.1.3-21.el8_10.noarch",
                  "product_id": "rsync-daemon-0:3.1.3-21.el8_10.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rsync-daemon@3.1.3-21.el8_10?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-0:3.1.3-21.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64"
        },
        "product_reference": "rsync-0:3.1.3-21.el8_10.aarch64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-0:3.1.3-21.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le"
        },
        "product_reference": "rsync-0:3.1.3-21.el8_10.ppc64le",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-0:3.1.3-21.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x"
        },
        "product_reference": "rsync-0:3.1.3-21.el8_10.s390x",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-0:3.1.3-21.el8_10.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src"
        },
        "product_reference": "rsync-0:3.1.3-21.el8_10.src",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-0:3.1.3-21.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64"
        },
        "product_reference": "rsync-0:3.1.3-21.el8_10.x86_64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-daemon-0:3.1.3-21.el8_10.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch"
        },
        "product_reference": "rsync-daemon-0:3.1.3-21.el8_10.noarch",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-debuginfo-0:3.1.3-21.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64"
        },
        "product_reference": "rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le"
        },
        "product_reference": "rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-debuginfo-0:3.1.3-21.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x"
        },
        "product_reference": "rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-debuginfo-0:3.1.3-21.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64"
        },
        "product_reference": "rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-debugsource-0:3.1.3-21.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64"
        },
        "product_reference": "rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-debugsource-0:3.1.3-21.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le"
        },
        "product_reference": "rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-debugsource-0:3.1.3-21.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x"
        },
        "product_reference": "rsync-debugsource-0:3.1.3-21.el8_10.s390x",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-debugsource-0:3.1.3-21.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
        },
        "product_reference": "rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Simon Scannell",
            "Pedro Gallegos",
            "Jasiel Spelman"
          ],
          "organization": "Google"
        }
      ],
      "cve": "CVE-2024-12087",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2024-12-05T21:23:24.139000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2330672"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client\u0027s intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rsync: Path traversal vulnerability in rsync",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this flaw to have moderate severity as it depends on specific configurations for the attack to succeed, symbolic link syncing must be  enabled (explicitly by providing the `--links` option or implicitly such as with `--archive`) and the client must connect to a malicious or compromised server.\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-35: Path Traversal: \u0027.../...//\u0027 vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nThe principle of least privilege is enforced through non-root containers, security context constraints, and pod-level security policies, which limit the actions a process can perform and reduce the potential impact of a successful exploit or misconfiguration. The platform enforces process isolation, ensuring workloads run with minimal privileges and are securely separated to limit the impact of path traversal attempts. Additionally, static code analysis and peer code review techniques are used to execute robust input validation and error-handling mechanisms to ensure all user inputs are thoroughly validated, preventing improperly validated inputs from causing system instability, exposing sensitive data, or escalating risks.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-12087"
        },
        {
          "category": "external",
          "summary": "RHBZ#2330672",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330672"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-12087",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-12087"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12087",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12087"
        },
        {
          "category": "external",
          "summary": "https://kb.cert.org/vuls/id/952657",
          "url": "https://kb.cert.org/vuls/id/952657"
        }
      ],
      "release_date": "2025-01-14T15:06:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-03-11T00:23:51+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:2600"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rsync: Path traversal vulnerability in rsync"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Simon Scannell",
            "Jasiel Spelman",
            "Pedro Gallegos"
          ],
          "organization": "Google"
        }
      ],
      "cve": "CVE-2024-12088",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2024-12-05T21:55:22.700000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2330676"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rsync: --safe-links option bypass leads to path traversal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Within regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-35: Path Traversal: \u0027.../...//\u0027 vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nThe principle of least privilege is enforced through non-root containers, security context constraints, and pod-level security policies, which limit the actions a process can perform and reduce the potential impact of a successful exploit or misconfiguration. The platform enforces process isolation, ensuring workloads run with minimal privileges and are securely separated to limit the impact of path traversal attempts. Additionally, static code analysis and peer code review techniques are used to execute robust input validation and error-handling mechanisms to ensure all user inputs are thoroughly validated, preventing improperly validated inputs from causing system instability, exposing sensitive data, or escalating risks.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-12088"
        },
        {
          "category": "external",
          "summary": "RHBZ#2330676",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330676"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-12088",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-12088"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12088",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12088"
        },
        {
          "category": "external",
          "summary": "https://kb.cert.org/vuls/id/952657",
          "url": "https://kb.cert.org/vuls/id/952657"
        }
      ],
      "release_date": "2025-01-14T15:06:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-03-11T00:23:51+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:2600"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rsync: --safe-links option bypass leads to path traversal"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Aleksei Gorban \"loqpa\""
          ]
        }
      ],
      "cve": "CVE-2024-12747",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "discovery_date": "2024-12-18T07:12:52.493000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2332968"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in rsync. This vulnerability arises from a race condition during rsync\u0027s handling of symbolic links. Rsync\u0027s default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rsync: Race Condition in rsync Handling Symbolic Links",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Within regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027) vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nRed Hat enforces the principle of least functionality, ensuring that only essential features, services, and ports are enabled. The environment leverages malicious code protections such as IPS/IDS and antimalware solutions that detect and respond to indicators in real time, limiting the impact of exploitation attempts. Static code analysis and peer code review techniques are used to execute robust input validation and error-handling mechanisms to ensure all user inputs are thoroughly validated, preventing improperly validated inputs from causing system instability, exposing sensitive data, or escalating risks. In the case of successful exploitation, detection and containment controls are in place to limit impacts by alerting on anomalous system behavior in real time, while process isolation and automated orchestration via Kubernetes minimize the likelihood of concurrent execution scenarios that would trigger the race condition and help contain the impact to a single process.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
          "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-12747"
        },
        {
          "category": "external",
          "summary": "RHBZ#2332968",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2332968"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-12747",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-12747"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12747",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12747"
        },
        {
          "category": "external",
          "summary": "https://kb.cert.org/vuls/id/952657",
          "url": "https://kb.cert.org/vuls/id/952657"
        }
      ],
      "release_date": "2025-01-14T15:06:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-03-11T00:23:51+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:2600"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rsync: Race Condition in rsync Handling Symbolic Links"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.