CVE-2022-29154

🗓️ 02 Aug 2022 14:22:52Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 643 Views🌐 WEB

CVE-2022-29154: Insecure file write in rsync before 3.2.

Reporter	Title	Published	Views	Family All 200
FreeBSD	rsync -- client-side arbitrary file write vulnerability	2 Aug 202200:00	–	freebsd
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM includes multiple components with known vulnerabilities	13 Feb 202313:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Access Appliance includes components with known vulnerabilities (CVE-2022-29154, CVE-2022-0391)	3 Apr 202321:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	7 Jun 202316:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.6.5 fixes multiple security vulnerabilities	26 Mar 202503:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities	26 Mar 202503:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Packet Capture includes components with multiple known vulnerabilities.	9 Nov 202218:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in Rsync [CVE-2022-29154]	29 Feb 202420:15	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak	24 Oct 202220:10	–	ibm
ATTACKERKB	CVE-2019-6111	31 Jan 201900:00	–	attackerkb

NVD

Node

samba rsyncRange<3.2.5

Node

Source	Link
openwall	www.openwall.com/lists/oss-security/2022/08/02/1
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRQAI7H4M4RQZ2IWZUEEXECBE5D56BH2/
github	www.github.com/WayneD/rsync/tags
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMBOJ77A7T7PQCARMDUK75TE6LLESZ3O/

Parameter	Position	Path	Description	CWE
target directory	path	.ssh/authorized_keys	Rsync client may be coerced by a malicious server to write arbitrary files into the client directory, overwriting sensitive files due to insufficient validation of file names.	CWE-20
authorized_keys	path	.ssh/authorized_keys	Rsync client may be coerced by a malicious server to write arbitrary files into the client directory, overwriting sensitive files due to insufficient validation of file names.	CWE-20

21 Nov 2024 06:58Current

7.7High risk

Vulners AI Score7.7

CVSS 3.17.4

EPSS0.00923