CBL Mariner 2.0 Security Update: rsync (CVE-2024-12087)

The version of rsync installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-12087 advisory. - A path traversal vulnerability exists in rsync. It stems from behavior enabled by the --inc-recursive option,...

CBL Mariner 2.0 Security Update: rsync (CVE-2024-12086)

The version of rsync installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-12086 advisory. - A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the...

CBL Mariner 2.0 Security Update: rsync (CVE-2024-12085)

The version of rsync installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-12085 advisory. - A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an...

Security update for rsync

This update for rsync fixes the following issues: CVE-2024-12085: leak of uninitialized stack data on the server leading to possible ASLR bypass. bsc1234101 CVE-2024-12086: leak of a client machine's file contents through the processing of checksum data. bsc1234102 CVE-2024-12087: arbitrary file...

RockyLinux 8 : rsync (RLSA-2025:0325)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:0325 advisory. rsync: Info Leak via Uninitialized Stack Contents CVE-2024-12085 Tenable has extracted the preceding description block directly from the RockyLinux security...

Important: rsync

Issue Overview: A flaw was found in the rsync daemon which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length s2length to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data...

CVE-2024-12747 affecting package rsync for versions less than 3.4.1-1

CVE-2024-12747 affecting package rsync for versions less than 3.4.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-12084 affecting package rsync for versions less than 3.4.1-1

CVE-2024-12084 affecting package rsync for versions less than 3.4.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-12086 affecting package rsync for versions less than 3.4.1-1

CVE-2024-12086 affecting package rsync for versions less than 3.4.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-12747 affecting package rsync for versions less than 3.4.1-1

CVE-2024-12747 affecting package rsync for versions less than 3.4.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-12084

CVE-2024-12084: Rsync daemon heap-based buffer overflow caused by improper handling of attacker-controlled checksum lengths (s2length). When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an out-of-bounds write to sum2 is possible. Public advisories confirm this bug affects rsync version...

CVE-2024-12084 Rsync: heap buffer overflow in rsync due to improper checksum length handling

A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths s2length in the code. When MAXDIGESTLEN exceeds the fixed SUMLENGTH 16 bytes, an attacker can write out of bounds in the sum2 buffer...

rsync: Info Leak via Uninitialized Stack Contents

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length s2length to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time...

Oracle Linux 8 : rsync (ELSA-2025-0325)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-0325 advisory. 3.1.3-20 - Resolves: RHEL-70157 - Info Leak via Uninitialized Stack Contents Tenable has extracted the preceding description block directly from the Oracle Linu...

CVE-2024-12087

A path traversal vulnerability exists in rsync. It stems from behavior enabled by the --inc-recursive option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the --inc-recursive option, a lack of proper...

AZL-55649 CVE-2024-12085 affecting package rsync for versions less than 3.4.1-1

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length s2length to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time...

CVE-2024-12088

A flaw was found in rsync. When using the --safe-links option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the...

CVE-2024-12747

A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass...

DEBIAN-CVE-2024-12087

A path traversal vulnerability exists in rsync. It stems from behavior enabled by the --inc-recursive option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the --inc-recursive option, a lack of proper...

AZL-55658 CVE-2024-12088 affecting package rsync for versions less than 3.4.1-1

A flaw was found in rsync. When using the --safe-links option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the...