Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2024-12087 (GCVE-0-2024-12087)
Vulnerability from cvelistv5 – Published: 2025-01-14 17:57 – Updated: 2026-04-14 21:41
VLAI
EPSS
Title
Rsync: path traversal vulnerability in rsync
Summary
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.
Severity
6.5 (Medium)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
16 references
Impacted products
20 products
| Vendor | Product | Version | |
|---|---|---|---|
|
Affected:
0 , ≤ 3.3.0
(semver)
|
|||
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
0:3.4.1-2.el10 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.0 |
|
| Red Hat | Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION |
Unaffected:
0:3.0.6-12.el6_10.2 , < *
(rpm)
cpe:/o:redhat:rhel_els:6 |
|
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support |
Unaffected:
0:3.1.2-12.el7_9.2 , < *
(rpm)
cpe:/o:redhat:rhel_els:7 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
Unaffected:
0:3.1.3-21.el8_10 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:8::baseos |
|
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support |
Unaffected:
0:3.1.3-7.el8_2.6 , < *
(rpm)
cpe:/o:redhat:rhel_aus:8.2::baseos |
|
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support |
Unaffected:
0:3.1.3-12.el8_4.6 , < *
(rpm)
cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_eus_long_life:8.4::baseos |
|
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On |
Unaffected:
0:3.1.3-12.el8_4.6 , < *
(rpm)
cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_eus_long_life:8.4::baseos |
|
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support |
Unaffected:
0:3.1.3-14.el8_6.9 , < *
(rpm)
cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos |
|
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service |
Unaffected:
0:3.1.3-14.el8_6.9 , < *
(rpm)
cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos |
|
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions |
Unaffected:
0:3.1.3-14.el8_6.9 , < *
(rpm)
cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos |
|
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service |
Unaffected:
0:3.1.3-20.el8_8.4 , < *
(rpm)
cpe:/o:redhat:rhel_e4s:8.8::baseos cpe:/o:redhat:rhel_tus:8.8::baseos |
|
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions |
Unaffected:
0:3.1.3-20.el8_8.4 , < *
(rpm)
cpe:/o:redhat:rhel_e4s:8.8::baseos cpe:/o:redhat:rhel_tus:8.8::baseos |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
0:3.2.5-3.el9 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:9::baseos cpe:/a:redhat:enterprise_linux:9::appstream |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
0:3.2.5-3.el9 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:9::baseos cpe:/a:redhat:enterprise_linux:9::appstream |
|
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions |
Unaffected:
0:3.2.3-9.el9_0.4 , < *
(rpm)
cpe:/o:redhat:rhel_e4s:9.0::baseos cpe:/a:redhat:rhel_e4s:9.0::appstream |
|
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions |
Unaffected:
0:3.2.3-19.el9_2.2 , < *
(rpm)
cpe:/a:redhat:rhel_e4s:9.2::appstream cpe:/o:redhat:rhel_e4s:9.2::baseos |
|
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support |
Unaffected:
0:3.2.3-19.el9_4.2 , < *
(rpm)
cpe:/o:redhat:rhel_eus:9.4::baseos cpe:/a:redhat:rhel_eus:9.4::appstream |
|
| Red Hat | Red Hat Discovery 1.14 |
Unaffected:
sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644 , < *
(rpm)
cpe:/a:redhat:discovery:1.14::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4 |
cpe:/a:redhat:openshift:4 |
Date Public
2025-01-14 15:06
Credits
Red Hat would like to thank Jasiel Spelman (Google), Pedro Gallegos (Google), and Simon Scannell (Google) for reporting this issue.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12087",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-26T14:12:12.897301Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-26T14:12:41.645Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T21:52:17.178Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://security.netapp.com/advisory/ntap-20250131-0002/"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00008.html"
},
{
"url": "https://www.kb.cert.org/vuls/id/952657"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/RsyncProject/rsync",
"defaultStatus": "unaffected",
"packageName": "rsync",
"versions": [
{
"lessThanOrEqual": "3.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.0"
],
"defaultStatus": "affected",
"packageName": "rsync",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.4.1-2.el10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:6"
],
"defaultStatus": "affected",
"packageName": "rsync",
"product": "Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.0.6-12.el6_10.2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "affected",
"packageName": "rsync",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.1.2-12.el7_9.2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8::baseos"
],
"defaultStatus": "affected",
"packageName": "rsync",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.1.3-21.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.2::baseos"
],
"defaultStatus": "affected",
"packageName": "rsync",
"product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.1.3-7.el8_2.6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.4::baseos",
"cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
],
"defaultStatus": "affected",
"packageName": "rsync",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.1.3-12.el8_4.6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.4::baseos",
"cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
],
"defaultStatus": "affected",
"packageName": "rsync",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.1.3-12.el8_4.6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6::baseos",
"cpe:/o:redhat:rhel_e4s:8.6::baseos",
"cpe:/o:redhat:rhel_tus:8.6::baseos"
],
"defaultStatus": "affected",
"packageName": "rsync",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.1.3-14.el8_6.9",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6::baseos",
"cpe:/o:redhat:rhel_e4s:8.6::baseos",
"cpe:/o:redhat:rhel_tus:8.6::baseos"
],
"defaultStatus": "affected",
"packageName": "rsync",
"product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.1.3-14.el8_6.9",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6::baseos",
"cpe:/o:redhat:rhel_e4s:8.6::baseos",
"cpe:/o:redhat:rhel_tus:8.6::baseos"
],
"defaultStatus": "affected",
"packageName": "rsync",
"product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.1.3-14.el8_6.9",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8::baseos",
"cpe:/o:redhat:rhel_tus:8.8::baseos"
],
"defaultStatus": "affected",
"packageName": "rsync",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.1.3-20.el8_8.4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8::baseos",
"cpe:/o:redhat:rhel_tus:8.8::baseos"
],
"defaultStatus": "affected",
"packageName": "rsync",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.1.3-20.el8_8.4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9::baseos",
"cpe:/a:redhat:enterprise_linux:9::appstream"
],
"defaultStatus": "affected",
"packageName": "rsync",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.2.5-3.el9",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9::baseos",
"cpe:/a:redhat:enterprise_linux:9::appstream"
],
"defaultStatus": "affected",
"packageName": "rsync",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.2.5-3.el9",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:9.0::baseos",
"cpe:/a:redhat:rhel_e4s:9.0::appstream"
],
"defaultStatus": "affected",
"packageName": "rsync",
"product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.2.3-9.el9_0.4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::appstream",
"cpe:/o:redhat:rhel_e4s:9.2::baseos"
],
"defaultStatus": "affected",
"packageName": "rsync",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.2.3-19.el9_2.2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus:9.4::baseos",
"cpe:/a:redhat:rhel_eus:9.4::appstream"
],
"defaultStatus": "affected",
"packageName": "rsync",
"product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.2.3-19.el9_4.2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:discovery:1.14::el9"
],
"defaultStatus": "affected",
"packageName": "discovery/discovery-ui-rhel9",
"product": "Red Hat Discovery 1.14",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Jasiel Spelman (Google), Pedro Gallegos (Google), and Simon Scannell (Google) for reporting this issue."
}
],
"datePublic": "2025-01-14T15:06:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client\u0027s intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-14T21:41:38.443Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHBA-2025:6470",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHBA-2025:6470"
},
{
"name": "RHSA-2025:23154",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2025:23154"
},
{
"name": "RHSA-2025:23235",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2025:23235"
},
{
"name": "RHSA-2025:23407",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2025:23407"
},
{
"name": "RHSA-2025:23415",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2025:23415"
},
{
"name": "RHSA-2025:23416",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2025:23416"
},
{
"name": "RHSA-2025:23842",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2025:23842"
},
{
"name": "RHSA-2025:23853",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2025:23853"
},
{
"name": "RHSA-2025:23854",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2025:23854"
},
{
"name": "RHSA-2025:23858",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2025:23858"
},
{
"name": "RHSA-2025:2600",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2025:2600"
},
{
"name": "RHSA-2025:7050",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2025:7050"
},
{
"name": "RHSA-2025:8385",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2024-12087"
},
{
"name": "RHBZ#2330672",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330672"
},
{
"url": "https://kb.cert.org/vuls/id/952657"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-12-05T21:23:24.139Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2025-01-14T15:06:00.000Z",
"value": "Made public."
}
],
"title": "Rsync: path traversal vulnerability in rsync",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2024-12087",
"datePublished": "2025-01-14T17:57:33.927Z",
"dateReserved": "2024-12-03T08:58:04.170Z",
"dateUpdated": "2026-04-14T21:41:38.443Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2024-12087",
"date": "2026-05-27",
"epss": "0.03189",
"percentile": "0.8716"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-12087\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2025-01-14T18:15:25.467\",\"lastModified\":\"2026-04-14T22:16:26.837\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client\u0027s intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.\"},{\"lang\":\"es\",\"value\":\"Existe una vulnerabilidad Path Traversal en rsync. Se origina en un comportamiento habilitado por la opci\u00f3n `--inc-recursive`, una opci\u00f3n habilitada de manera predeterminada para muchas opciones de cliente y que puede ser habilitada por el servidor incluso si no est\u00e1 habilitada expl\u00edcitamente por el cliente. Al usar la opci\u00f3n `--inc-recursive`, la falta de una verificaci\u00f3n de enlace simb\u00f3lico adecuada junto con las comprobaciones de deduplicaci\u00f3n que se realizan en una lista de archivos por archivo podr\u00eda permitir que un servidor escriba archivos fuera del directorio de destino previsto del cliente. Un servidor malintencionado podr\u00eda escribir archivos malintencionados en ubicaciones arbitrarias con nombres de directorios/rutas v\u00e1lidos en el cliente.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"3.3.0\",\"matchCriteriaId\":\"477D69AB-8601-4994-9695-8DE48E1587A5\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:almalinux:almalinux:8.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"F34AA7F4-6ECE-4FA5-A310-3509648BD7C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:almalinux:almalinux:9.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"57B93E9A-1483-4FF7-BF45-BD0D7D9F1747\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:almalinux:almalinux:10.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"66FD02F3-C1C2-4E1D-98C1-8889004437D4\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:archlinux:arch_linux:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4824AE2D-462B-477D-9206-3E2090A32146\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:gentoo:linux:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"92121D8A-529E-454A-BC8D-B6E0017E615D\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nixos:nixos:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"24.11\",\"matchCriteriaId\":\"213883D5-9E62-4496-82E3-D5377995C257\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:suse:suse_linux:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1FB65EF0-0E6A-4178-8564-3CC96891A072\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:tritondatacenter:smartos:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"20250123\",\"matchCriteriaId\":\"8EBD774C-F48F-45EC-A5DD-B1E56E54EF71\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4CFF558-3C47-480D-A2F0-BABF26042943\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F6FB57C-2BC7-487C-96DD-132683AEB35D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C4CF8D2F-DACA-49C2-A9F4-63496B0A9A80\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A47EF78-A5B6-4B89-8B74-EEB0647C549F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2F7DAD7C-9369-4A87-A1D0-4208D3AF0CDC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.6_aarch64:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA15BFFC-B8E8-4EE3-8E14-8C95DF6C99C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"32AF225E-94C0-4D07-900C-DD868C05F554\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FB056B47-1F45-4CE4-81F6-872F66C24C29\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"778ACA25-ED77-4EFC-A183-DE094C58B268\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"23D471AC-7DCA-4425-AD91-E5D928753A8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E07C1C58-0E5F-4B56-9B8D-5DE67DB00F79\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0516993E-CBD5-44F1-8684-7172C9ABFD0A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_aus:9.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0FDD919E-B7FE-4EC5-8D6B-EC9A4723D6E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.6_ppc64le:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"41F1A2F3-BCEF-4A8C-BA2F-DF1FF13E6179\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"554AA8CA-A930-4788-B052-497E09D48381\"}]}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHBA-2025:6470\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2025:23154\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2025:23235\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2025:23407\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2025:23415\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2025:23416\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2025:23842\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2025:23853\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2025:23854\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2025:23858\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2025:2600\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2025:7050\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2025:8385\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/security/cve/CVE-2024-12087\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2330672\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://kb.cert.org/vuls/id/952657\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20250131-0002/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.kb.cert.org/vuls/id/952657\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://security.netapp.com/advisory/ntap-20250131-0002/\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00008.html\"}, {\"url\": \"https://www.kb.cert.org/vuls/id/952657\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T21:52:17.178Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-12087\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-26T14:12:12.897301Z\"}}}], \"references\": [{\"url\": \"https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-15T15:03:56.504Z\"}}], \"cna\": {\"title\": \"Rsync: path traversal vulnerability in rsync\", \"credits\": [{\"lang\": \"en\", \"value\": \"Red Hat would like to thank Jasiel Spelman (Google), Pedro Gallegos (Google), and Simon Scannell (Google) for reporting this issue.\"}], \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Moderate\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"3.3.0\"}], \"packageName\": \"rsync\", \"collectionURL\": \"https://github.com/RsyncProject/rsync\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.4.1-2.el10\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rsync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:rhel_els:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.0.6-12.el6_10.2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rsync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:rhel_els:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7 Extended Lifecycle Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.2-12.el7_9.2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rsync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.3-21.el8_10\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rsync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:rhel_aus:8.2::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.2 Advanced Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.3-7.el8_2.6\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rsync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:rhel_aus:8.4::baseos\", \"cpe:/o:redhat:rhel_eus_long_life:8.4::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.3-12.el8_4.6\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rsync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:rhel_aus:8.4::baseos\", \"cpe:/o:redhat:rhel_eus_long_life:8.4::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.3-12.el8_4.6\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rsync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:rhel_aus:8.6::baseos\", \"cpe:/o:redhat:rhel_e4s:8.6::baseos\", \"cpe:/o:redhat:rhel_tus:8.6::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.3-14.el8_6.9\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rsync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:rhel_aus:8.6::baseos\", \"cpe:/o:redhat:rhel_e4s:8.6::baseos\", \"cpe:/o:redhat:rhel_tus:8.6::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.6 Telecommunications Update Service\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.3-14.el8_6.9\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rsync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:rhel_aus:8.6::baseos\", \"cpe:/o:redhat:rhel_e4s:8.6::baseos\", \"cpe:/o:redhat:rhel_tus:8.6::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.3-14.el8_6.9\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rsync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:rhel_e4s:8.8::baseos\", \"cpe:/o:redhat:rhel_tus:8.8::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.8 Telecommunications Update Service\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.3-20.el8_8.4\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rsync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:rhel_e4s:8.8::baseos\", \"cpe:/o:redhat:rhel_tus:8.8::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.3-20.el8_8.4\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rsync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9::baseos\", \"cpe:/a:redhat:enterprise_linux:9::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.2.5-3.el9\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rsync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9::baseos\", \"cpe:/a:redhat:enterprise_linux:9::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.2.5-3.el9\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rsync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:rhel_e4s:9.0::baseos\", \"cpe:/a:redhat:rhel_e4s:9.0::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.2.3-9.el9_0.4\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rsync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:9.2::appstream\", \"cpe:/o:redhat:rhel_e4s:9.2::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.2.3-19.el9_2.2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rsync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:rhel_eus:9.4::baseos\", \"cpe:/a:redhat:rhel_eus:9.4::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9.4 Extended Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.2.3-19.el9_4.2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rsync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:discovery:1.14::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Discovery 1.14\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"discovery/discovery-ui-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"rhcos\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2024-12-05T21:23:24.139Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2025-01-14T15:06:00.000Z\", \"value\": \"Made public.\"}], \"datePublic\": \"2025-01-14T15:06:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/errata/RHBA-2025:6470\", \"name\": \"RHBA-2025:6470\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2025:23154\", \"name\": \"RHSA-2025:23154\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2025:23235\", \"name\": \"RHSA-2025:23235\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2025:23407\", \"name\": \"RHSA-2025:23407\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2025:23415\", \"name\": \"RHSA-2025:23415\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2025:23416\", \"name\": \"RHSA-2025:23416\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2025:23842\", \"name\": \"RHSA-2025:23842\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2025:23853\", \"name\": \"RHSA-2025:23853\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2025:23854\", \"name\": \"RHSA-2025:23854\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2025:23858\", \"name\": \"RHSA-2025:23858\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2025:2600\", \"name\": \"RHSA-2025:2600\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2025:7050\", \"name\": \"RHSA-2025:7050\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2025:8385\", \"name\": \"RHSA-2025:8385\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2024-12087\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2330672\", \"name\": \"RHBZ#2330672\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://kb.cert.org/vuls/id/952657\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client\u0027s intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-04-14T21:41:38.443Z\"}, \"x_redhatCweChain\": \"CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-12087\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-14T21:41:38.443Z\", \"dateReserved\": \"2024-12-03T08:58:04.170Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2025-01-14T17:57:33.927Z\", \"assignerShortName\": \"redhat\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2025:23842
Vulnerability from csaf_redhat - Published: 2025-12-22 09:46 - Updated: 2026-04-14 21:41Summary
Red Hat Security Advisory: rsync security update
Severity
Moderate
Notes
Topic: An update for rsync is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.
Security Fix(es):
* rsync: Path traversal vulnerability in rsync (CVE-2024-12087)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.
6.5 (Medium)
Affected products
Fixed
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: BaseOS-8.2.0.Z.AUS:rsync-0:3.1.3-7.el8_2.6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.2.0.Z.AUS:rsync-0:3.1.3-7.el8_2.6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.2.0.Z.AUS:rsync-daemon-0:3.1.3-7.el8_2.6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.2.0.Z.AUS:rsync-debuginfo-0:3.1.3-7.el8_2.6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.2.0.Z.AUS:rsync-debugsource-0:3.1.3-7.el8_2.6.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
References
9 references
Acknowledgments
Google
Simon Scannell
Pedro Gallegos
Jasiel Spelman
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for rsync is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: Path traversal vulnerability in rsync (CVE-2024-12087)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:23842",
"url": "https://access.redhat.com/errata/RHSA-2025:23842"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "2330672",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330672"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23842.json"
}
],
"title": "Red Hat Security Advisory: rsync security update",
"tracking": {
"current_release_date": "2026-04-14T21:41:50+00:00",
"generator": {
"date": "2026-04-14T21:41:50+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.5"
}
},
"id": "RHSA-2025:23842",
"initial_release_date": "2025-12-22T09:46:13+00:00",
"revision_history": [
{
"date": "2025-12-22T09:46:13+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-12-22T09:46:13+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-04-14T21:41:50+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
"product": {
"name": "Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
"product_id": "BaseOS-8.2.0.Z.AUS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_aus:8.2::baseos"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.1.3-7.el8_2.6.x86_64",
"product": {
"name": "rsync-0:3.1.3-7.el8_2.6.x86_64",
"product_id": "rsync-0:3.1.3-7.el8_2.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.1.3-7.el8_2.6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rsync-debugsource-0:3.1.3-7.el8_2.6.x86_64",
"product": {
"name": "rsync-debugsource-0:3.1.3-7.el8_2.6.x86_64",
"product_id": "rsync-debugsource-0:3.1.3-7.el8_2.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debugsource@3.1.3-7.el8_2.6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rsync-debuginfo-0:3.1.3-7.el8_2.6.x86_64",
"product": {
"name": "rsync-debuginfo-0:3.1.3-7.el8_2.6.x86_64",
"product_id": "rsync-debuginfo-0:3.1.3-7.el8_2.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debuginfo@3.1.3-7.el8_2.6?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.1.3-7.el8_2.6.src",
"product": {
"name": "rsync-0:3.1.3-7.el8_2.6.src",
"product_id": "rsync-0:3.1.3-7.el8_2.6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.1.3-7.el8_2.6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-daemon-0:3.1.3-7.el8_2.6.noarch",
"product": {
"name": "rsync-daemon-0:3.1.3-7.el8_2.6.noarch",
"product_id": "rsync-daemon-0:3.1.3-7.el8_2.6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-daemon@3.1.3-7.el8_2.6?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-7.el8_2.6.src as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
"product_id": "BaseOS-8.2.0.Z.AUS:rsync-0:3.1.3-7.el8_2.6.src"
},
"product_reference": "rsync-0:3.1.3-7.el8_2.6.src",
"relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-7.el8_2.6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
"product_id": "BaseOS-8.2.0.Z.AUS:rsync-0:3.1.3-7.el8_2.6.x86_64"
},
"product_reference": "rsync-0:3.1.3-7.el8_2.6.x86_64",
"relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-daemon-0:3.1.3-7.el8_2.6.noarch as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
"product_id": "BaseOS-8.2.0.Z.AUS:rsync-daemon-0:3.1.3-7.el8_2.6.noarch"
},
"product_reference": "rsync-daemon-0:3.1.3-7.el8_2.6.noarch",
"relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.1.3-7.el8_2.6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
"product_id": "BaseOS-8.2.0.Z.AUS:rsync-debuginfo-0:3.1.3-7.el8_2.6.x86_64"
},
"product_reference": "rsync-debuginfo-0:3.1.3-7.el8_2.6.x86_64",
"relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.1.3-7.el8_2.6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
"product_id": "BaseOS-8.2.0.Z.AUS:rsync-debugsource-0:3.1.3-7.el8_2.6.x86_64"
},
"product_reference": "rsync-debugsource-0:3.1.3-7.el8_2.6.x86_64",
"relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Simon Scannell",
"Pedro Gallegos",
"Jasiel Spelman"
],
"organization": "Google"
}
],
"cve": "CVE-2024-12087",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2024-12-05T21:23:24.139000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2330672"
}
],
"notes": [
{
"category": "description",
"text": "A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client\u0027s intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: Path traversal vulnerability in rsync",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw to have moderate severity as it depends on specific configurations for the attack to succeed, symbolic link syncing must be enabled (explicitly by providing the `--links` option or implicitly such as with `--archive`) and the client must connect to a malicious or compromised server.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"BaseOS-8.2.0.Z.AUS:rsync-0:3.1.3-7.el8_2.6.src",
"BaseOS-8.2.0.Z.AUS:rsync-0:3.1.3-7.el8_2.6.x86_64",
"BaseOS-8.2.0.Z.AUS:rsync-daemon-0:3.1.3-7.el8_2.6.noarch",
"BaseOS-8.2.0.Z.AUS:rsync-debuginfo-0:3.1.3-7.el8_2.6.x86_64",
"BaseOS-8.2.0.Z.AUS:rsync-debugsource-0:3.1.3-7.el8_2.6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-12087"
},
{
"category": "external",
"summary": "RHBZ#2330672",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330672"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-12087",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12087"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12087",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12087"
},
{
"category": "external",
"summary": "https://kb.cert.org/vuls/id/952657",
"url": "https://kb.cert.org/vuls/id/952657"
}
],
"release_date": "2025-01-14T15:06:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T09:46:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"BaseOS-8.2.0.Z.AUS:rsync-0:3.1.3-7.el8_2.6.src",
"BaseOS-8.2.0.Z.AUS:rsync-0:3.1.3-7.el8_2.6.x86_64",
"BaseOS-8.2.0.Z.AUS:rsync-daemon-0:3.1.3-7.el8_2.6.noarch",
"BaseOS-8.2.0.Z.AUS:rsync-debuginfo-0:3.1.3-7.el8_2.6.x86_64",
"BaseOS-8.2.0.Z.AUS:rsync-debugsource-0:3.1.3-7.el8_2.6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23842"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"BaseOS-8.2.0.Z.AUS:rsync-0:3.1.3-7.el8_2.6.src",
"BaseOS-8.2.0.Z.AUS:rsync-0:3.1.3-7.el8_2.6.x86_64",
"BaseOS-8.2.0.Z.AUS:rsync-daemon-0:3.1.3-7.el8_2.6.noarch",
"BaseOS-8.2.0.Z.AUS:rsync-debuginfo-0:3.1.3-7.el8_2.6.x86_64",
"BaseOS-8.2.0.Z.AUS:rsync-debugsource-0:3.1.3-7.el8_2.6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"BaseOS-8.2.0.Z.AUS:rsync-0:3.1.3-7.el8_2.6.src",
"BaseOS-8.2.0.Z.AUS:rsync-0:3.1.3-7.el8_2.6.x86_64",
"BaseOS-8.2.0.Z.AUS:rsync-daemon-0:3.1.3-7.el8_2.6.noarch",
"BaseOS-8.2.0.Z.AUS:rsync-debuginfo-0:3.1.3-7.el8_2.6.x86_64",
"BaseOS-8.2.0.Z.AUS:rsync-debugsource-0:3.1.3-7.el8_2.6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsync: Path traversal vulnerability in rsync"
}
]
}
RHSA-2025:23853
Vulnerability from csaf_redhat - Published: 2025-12-22 11:41 - Updated: 2026-04-14 21:41Summary
Red Hat Security Advisory: rsync security update
Severity
Moderate
Notes
Topic: An update for rsync is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.
Security Fix(es):
* rsync: Path traversal vulnerability in rsync (CVE-2024-12087)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.
6.5 (Medium)
Affected products
Fixed
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: BaseOS-8.4.0.Z.AUS:rsync-0:3.1.3-12.el8_4.6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.Z.AUS:rsync-0:3.1.3-12.el8_4.6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.Z.AUS:rsync-daemon-0:3.1.3-12.el8_4.6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.Z.AUS:rsync-debuginfo-0:3.1.3-12.el8_4.6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.Z.AUS:rsync-debugsource-0:3.1.3-12.el8_4.6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-0:3.1.3-12.el8_4.6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-0:3.1.3-12.el8_4.6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-daemon-0:3.1.3-12.el8_4.6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-debuginfo-0:3.1.3-12.el8_4.6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-debugsource-0:3.1.3-12.el8_4.6.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
References
9 references
Acknowledgments
Google
Simon Scannell
Pedro Gallegos
Jasiel Spelman
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for rsync is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: Path traversal vulnerability in rsync (CVE-2024-12087)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:23853",
"url": "https://access.redhat.com/errata/RHSA-2025:23853"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "2330672",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330672"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23853.json"
}
],
"title": "Red Hat Security Advisory: rsync security update",
"tracking": {
"current_release_date": "2026-04-14T21:41:51+00:00",
"generator": {
"date": "2026-04-14T21:41:51+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.5"
}
},
"id": "RHSA-2025:23853",
"initial_release_date": "2025-12-22T11:41:13+00:00",
"revision_history": [
{
"date": "2025-12-22T11:41:13+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-12-22T11:41:13+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-04-14T21:41:51+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux BaseOS AUS (v.8.4)",
"product": {
"name": "Red Hat Enterprise Linux BaseOS AUS (v.8.4)",
"product_id": "BaseOS-8.4.0.Z.AUS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_aus:8.4::baseos"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)",
"product": {
"name": "Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)",
"product_id": "BaseOS-8.4.0.Z.EUS.EXTENSION",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.1.3-12.el8_4.6.src",
"product": {
"name": "rsync-0:3.1.3-12.el8_4.6.src",
"product_id": "rsync-0:3.1.3-12.el8_4.6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.1.3-12.el8_4.6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.1.3-12.el8_4.6.x86_64",
"product": {
"name": "rsync-0:3.1.3-12.el8_4.6.x86_64",
"product_id": "rsync-0:3.1.3-12.el8_4.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.1.3-12.el8_4.6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rsync-debugsource-0:3.1.3-12.el8_4.6.x86_64",
"product": {
"name": "rsync-debugsource-0:3.1.3-12.el8_4.6.x86_64",
"product_id": "rsync-debugsource-0:3.1.3-12.el8_4.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debugsource@3.1.3-12.el8_4.6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rsync-debuginfo-0:3.1.3-12.el8_4.6.x86_64",
"product": {
"name": "rsync-debuginfo-0:3.1.3-12.el8_4.6.x86_64",
"product_id": "rsync-debuginfo-0:3.1.3-12.el8_4.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debuginfo@3.1.3-12.el8_4.6?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-daemon-0:3.1.3-12.el8_4.6.noarch",
"product": {
"name": "rsync-daemon-0:3.1.3-12.el8_4.6.noarch",
"product_id": "rsync-daemon-0:3.1.3-12.el8_4.6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-daemon@3.1.3-12.el8_4.6?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-12.el8_4.6.src as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)",
"product_id": "BaseOS-8.4.0.Z.AUS:rsync-0:3.1.3-12.el8_4.6.src"
},
"product_reference": "rsync-0:3.1.3-12.el8_4.6.src",
"relates_to_product_reference": "BaseOS-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-12.el8_4.6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)",
"product_id": "BaseOS-8.4.0.Z.AUS:rsync-0:3.1.3-12.el8_4.6.x86_64"
},
"product_reference": "rsync-0:3.1.3-12.el8_4.6.x86_64",
"relates_to_product_reference": "BaseOS-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-daemon-0:3.1.3-12.el8_4.6.noarch as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)",
"product_id": "BaseOS-8.4.0.Z.AUS:rsync-daemon-0:3.1.3-12.el8_4.6.noarch"
},
"product_reference": "rsync-daemon-0:3.1.3-12.el8_4.6.noarch",
"relates_to_product_reference": "BaseOS-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.1.3-12.el8_4.6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)",
"product_id": "BaseOS-8.4.0.Z.AUS:rsync-debuginfo-0:3.1.3-12.el8_4.6.x86_64"
},
"product_reference": "rsync-debuginfo-0:3.1.3-12.el8_4.6.x86_64",
"relates_to_product_reference": "BaseOS-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.1.3-12.el8_4.6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)",
"product_id": "BaseOS-8.4.0.Z.AUS:rsync-debugsource-0:3.1.3-12.el8_4.6.x86_64"
},
"product_reference": "rsync-debugsource-0:3.1.3-12.el8_4.6.x86_64",
"relates_to_product_reference": "BaseOS-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-12.el8_4.6.src as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)",
"product_id": "BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-0:3.1.3-12.el8_4.6.src"
},
"product_reference": "rsync-0:3.1.3-12.el8_4.6.src",
"relates_to_product_reference": "BaseOS-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-12.el8_4.6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)",
"product_id": "BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-0:3.1.3-12.el8_4.6.x86_64"
},
"product_reference": "rsync-0:3.1.3-12.el8_4.6.x86_64",
"relates_to_product_reference": "BaseOS-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-daemon-0:3.1.3-12.el8_4.6.noarch as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)",
"product_id": "BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-daemon-0:3.1.3-12.el8_4.6.noarch"
},
"product_reference": "rsync-daemon-0:3.1.3-12.el8_4.6.noarch",
"relates_to_product_reference": "BaseOS-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.1.3-12.el8_4.6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)",
"product_id": "BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-debuginfo-0:3.1.3-12.el8_4.6.x86_64"
},
"product_reference": "rsync-debuginfo-0:3.1.3-12.el8_4.6.x86_64",
"relates_to_product_reference": "BaseOS-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.1.3-12.el8_4.6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)",
"product_id": "BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-debugsource-0:3.1.3-12.el8_4.6.x86_64"
},
"product_reference": "rsync-debugsource-0:3.1.3-12.el8_4.6.x86_64",
"relates_to_product_reference": "BaseOS-8.4.0.Z.EUS.EXTENSION"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Simon Scannell",
"Pedro Gallegos",
"Jasiel Spelman"
],
"organization": "Google"
}
],
"cve": "CVE-2024-12087",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2024-12-05T21:23:24.139000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2330672"
}
],
"notes": [
{
"category": "description",
"text": "A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client\u0027s intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: Path traversal vulnerability in rsync",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw to have moderate severity as it depends on specific configurations for the attack to succeed, symbolic link syncing must be enabled (explicitly by providing the `--links` option or implicitly such as with `--archive`) and the client must connect to a malicious or compromised server.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"BaseOS-8.4.0.Z.AUS:rsync-0:3.1.3-12.el8_4.6.src",
"BaseOS-8.4.0.Z.AUS:rsync-0:3.1.3-12.el8_4.6.x86_64",
"BaseOS-8.4.0.Z.AUS:rsync-daemon-0:3.1.3-12.el8_4.6.noarch",
"BaseOS-8.4.0.Z.AUS:rsync-debuginfo-0:3.1.3-12.el8_4.6.x86_64",
"BaseOS-8.4.0.Z.AUS:rsync-debugsource-0:3.1.3-12.el8_4.6.x86_64",
"BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-0:3.1.3-12.el8_4.6.src",
"BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-0:3.1.3-12.el8_4.6.x86_64",
"BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-daemon-0:3.1.3-12.el8_4.6.noarch",
"BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-debuginfo-0:3.1.3-12.el8_4.6.x86_64",
"BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-debugsource-0:3.1.3-12.el8_4.6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-12087"
},
{
"category": "external",
"summary": "RHBZ#2330672",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330672"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-12087",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12087"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12087",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12087"
},
{
"category": "external",
"summary": "https://kb.cert.org/vuls/id/952657",
"url": "https://kb.cert.org/vuls/id/952657"
}
],
"release_date": "2025-01-14T15:06:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T11:41:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"BaseOS-8.4.0.Z.AUS:rsync-0:3.1.3-12.el8_4.6.src",
"BaseOS-8.4.0.Z.AUS:rsync-0:3.1.3-12.el8_4.6.x86_64",
"BaseOS-8.4.0.Z.AUS:rsync-daemon-0:3.1.3-12.el8_4.6.noarch",
"BaseOS-8.4.0.Z.AUS:rsync-debuginfo-0:3.1.3-12.el8_4.6.x86_64",
"BaseOS-8.4.0.Z.AUS:rsync-debugsource-0:3.1.3-12.el8_4.6.x86_64",
"BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-0:3.1.3-12.el8_4.6.src",
"BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-0:3.1.3-12.el8_4.6.x86_64",
"BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-daemon-0:3.1.3-12.el8_4.6.noarch",
"BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-debuginfo-0:3.1.3-12.el8_4.6.x86_64",
"BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-debugsource-0:3.1.3-12.el8_4.6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"BaseOS-8.4.0.Z.AUS:rsync-0:3.1.3-12.el8_4.6.src",
"BaseOS-8.4.0.Z.AUS:rsync-0:3.1.3-12.el8_4.6.x86_64",
"BaseOS-8.4.0.Z.AUS:rsync-daemon-0:3.1.3-12.el8_4.6.noarch",
"BaseOS-8.4.0.Z.AUS:rsync-debuginfo-0:3.1.3-12.el8_4.6.x86_64",
"BaseOS-8.4.0.Z.AUS:rsync-debugsource-0:3.1.3-12.el8_4.6.x86_64",
"BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-0:3.1.3-12.el8_4.6.src",
"BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-0:3.1.3-12.el8_4.6.x86_64",
"BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-daemon-0:3.1.3-12.el8_4.6.noarch",
"BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-debuginfo-0:3.1.3-12.el8_4.6.x86_64",
"BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-debugsource-0:3.1.3-12.el8_4.6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"BaseOS-8.4.0.Z.AUS:rsync-0:3.1.3-12.el8_4.6.src",
"BaseOS-8.4.0.Z.AUS:rsync-0:3.1.3-12.el8_4.6.x86_64",
"BaseOS-8.4.0.Z.AUS:rsync-daemon-0:3.1.3-12.el8_4.6.noarch",
"BaseOS-8.4.0.Z.AUS:rsync-debuginfo-0:3.1.3-12.el8_4.6.x86_64",
"BaseOS-8.4.0.Z.AUS:rsync-debugsource-0:3.1.3-12.el8_4.6.x86_64",
"BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-0:3.1.3-12.el8_4.6.src",
"BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-0:3.1.3-12.el8_4.6.x86_64",
"BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-daemon-0:3.1.3-12.el8_4.6.noarch",
"BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-debuginfo-0:3.1.3-12.el8_4.6.x86_64",
"BaseOS-8.4.0.Z.EUS.EXTENSION:rsync-debugsource-0:3.1.3-12.el8_4.6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsync: Path traversal vulnerability in rsync"
}
]
}
RHSA-2025:23854
Vulnerability from csaf_redhat - Published: 2025-12-22 12:14 - Updated: 2026-04-14 21:41Summary
Red Hat Security Advisory: rsync security update
Severity
Moderate
Notes
Topic: An update for rsync is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.
Security Fix(es):
* rsync: Path traversal vulnerability in rsync (CVE-2024-12087)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.
6.5 (Medium)
Affected products
Fixed
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: BaseOS-8.6.0.Z.AUS:rsync-0:3.1.3-14.el8_6.9.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.AUS:rsync-0:3.1.3-14.el8_6.9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.AUS:rsync-daemon-0:3.1.3-14.el8_6.9.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.AUS:rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.AUS:rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S:rsync-daemon-0:3.1.3-14.el8_6.9.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S:rsync-debuginfo-0:3.1.3-14.el8_6.9.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S:rsync-debuginfo-0:3.1.3-14.el8_6.9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S:rsync-debuginfo-0:3.1.3-14.el8_6.9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S:rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S:rsync-debugsource-0:3.1.3-14.el8_6.9.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S:rsync-debugsource-0:3.1.3-14.el8_6.9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S:rsync-debugsource-0:3.1.3-14.el8_6.9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.E4S:rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.TUS:rsync-0:3.1.3-14.el8_6.9.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.TUS:rsync-0:3.1.3-14.el8_6.9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.TUS:rsync-daemon-0:3.1.3-14.el8_6.9.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.TUS:rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.6.0.Z.TUS:rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
References
9 references
Acknowledgments
Google
Simon Scannell
Pedro Gallegos
Jasiel Spelman
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for rsync is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: Path traversal vulnerability in rsync (CVE-2024-12087)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:23854",
"url": "https://access.redhat.com/errata/RHSA-2025:23854"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "2330672",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330672"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23854.json"
}
],
"title": "Red Hat Security Advisory: rsync security update",
"tracking": {
"current_release_date": "2026-04-14T21:41:51+00:00",
"generator": {
"date": "2026-04-14T21:41:51+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.5"
}
},
"id": "RHSA-2025:23854",
"initial_release_date": "2025-12-22T12:14:03+00:00",
"revision_history": [
{
"date": "2025-12-22T12:14:03+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-12-22T12:14:03+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-04-14T21:41:51+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
"product": {
"name": "Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.AUS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_aus:8.6::baseos"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
"product": {
"name": "Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.E4S",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_e4s:8.6::baseos"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux BaseOS TUS (v.8.6)",
"product": {
"name": "Red Hat Enterprise Linux BaseOS TUS (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.TUS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_tus:8.6::baseos"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.1.3-14.el8_6.9.src",
"product": {
"name": "rsync-0:3.1.3-14.el8_6.9.src",
"product_id": "rsync-0:3.1.3-14.el8_6.9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.1.3-14.el8_6.9?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.1.3-14.el8_6.9.x86_64",
"product": {
"name": "rsync-0:3.1.3-14.el8_6.9.x86_64",
"product_id": "rsync-0:3.1.3-14.el8_6.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.1.3-14.el8_6.9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64",
"product": {
"name": "rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64",
"product_id": "rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debugsource@3.1.3-14.el8_6.9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64",
"product": {
"name": "rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64",
"product_id": "rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debuginfo@3.1.3-14.el8_6.9?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-daemon-0:3.1.3-14.el8_6.9.noarch",
"product": {
"name": "rsync-daemon-0:3.1.3-14.el8_6.9.noarch",
"product_id": "rsync-daemon-0:3.1.3-14.el8_6.9.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-daemon@3.1.3-14.el8_6.9?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.1.3-14.el8_6.9.aarch64",
"product": {
"name": "rsync-0:3.1.3-14.el8_6.9.aarch64",
"product_id": "rsync-0:3.1.3-14.el8_6.9.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.1.3-14.el8_6.9?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "rsync-debugsource-0:3.1.3-14.el8_6.9.aarch64",
"product": {
"name": "rsync-debugsource-0:3.1.3-14.el8_6.9.aarch64",
"product_id": "rsync-debugsource-0:3.1.3-14.el8_6.9.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debugsource@3.1.3-14.el8_6.9?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "rsync-debuginfo-0:3.1.3-14.el8_6.9.aarch64",
"product": {
"name": "rsync-debuginfo-0:3.1.3-14.el8_6.9.aarch64",
"product_id": "rsync-debuginfo-0:3.1.3-14.el8_6.9.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debuginfo@3.1.3-14.el8_6.9?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.1.3-14.el8_6.9.ppc64le",
"product": {
"name": "rsync-0:3.1.3-14.el8_6.9.ppc64le",
"product_id": "rsync-0:3.1.3-14.el8_6.9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.1.3-14.el8_6.9?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "rsync-debugsource-0:3.1.3-14.el8_6.9.ppc64le",
"product": {
"name": "rsync-debugsource-0:3.1.3-14.el8_6.9.ppc64le",
"product_id": "rsync-debugsource-0:3.1.3-14.el8_6.9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debugsource@3.1.3-14.el8_6.9?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "rsync-debuginfo-0:3.1.3-14.el8_6.9.ppc64le",
"product": {
"name": "rsync-debuginfo-0:3.1.3-14.el8_6.9.ppc64le",
"product_id": "rsync-debuginfo-0:3.1.3-14.el8_6.9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debuginfo@3.1.3-14.el8_6.9?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.1.3-14.el8_6.9.s390x",
"product": {
"name": "rsync-0:3.1.3-14.el8_6.9.s390x",
"product_id": "rsync-0:3.1.3-14.el8_6.9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.1.3-14.el8_6.9?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "rsync-debugsource-0:3.1.3-14.el8_6.9.s390x",
"product": {
"name": "rsync-debugsource-0:3.1.3-14.el8_6.9.s390x",
"product_id": "rsync-debugsource-0:3.1.3-14.el8_6.9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debugsource@3.1.3-14.el8_6.9?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "rsync-debuginfo-0:3.1.3-14.el8_6.9.s390x",
"product": {
"name": "rsync-debuginfo-0:3.1.3-14.el8_6.9.s390x",
"product_id": "rsync-debuginfo-0:3.1.3-14.el8_6.9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debuginfo@3.1.3-14.el8_6.9?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-14.el8_6.9.src as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.AUS:rsync-0:3.1.3-14.el8_6.9.src"
},
"product_reference": "rsync-0:3.1.3-14.el8_6.9.src",
"relates_to_product_reference": "BaseOS-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-14.el8_6.9.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.AUS:rsync-0:3.1.3-14.el8_6.9.x86_64"
},
"product_reference": "rsync-0:3.1.3-14.el8_6.9.x86_64",
"relates_to_product_reference": "BaseOS-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-daemon-0:3.1.3-14.el8_6.9.noarch as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.AUS:rsync-daemon-0:3.1.3-14.el8_6.9.noarch"
},
"product_reference": "rsync-daemon-0:3.1.3-14.el8_6.9.noarch",
"relates_to_product_reference": "BaseOS-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.AUS:rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64"
},
"product_reference": "rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64",
"relates_to_product_reference": "BaseOS-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.AUS:rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64"
},
"product_reference": "rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64",
"relates_to_product_reference": "BaseOS-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-14.el8_6.9.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.aarch64"
},
"product_reference": "rsync-0:3.1.3-14.el8_6.9.aarch64",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-14.el8_6.9.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.ppc64le"
},
"product_reference": "rsync-0:3.1.3-14.el8_6.9.ppc64le",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-14.el8_6.9.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.s390x"
},
"product_reference": "rsync-0:3.1.3-14.el8_6.9.s390x",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-14.el8_6.9.src as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.src"
},
"product_reference": "rsync-0:3.1.3-14.el8_6.9.src",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-14.el8_6.9.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.x86_64"
},
"product_reference": "rsync-0:3.1.3-14.el8_6.9.x86_64",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-daemon-0:3.1.3-14.el8_6.9.noarch as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.E4S:rsync-daemon-0:3.1.3-14.el8_6.9.noarch"
},
"product_reference": "rsync-daemon-0:3.1.3-14.el8_6.9.noarch",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.1.3-14.el8_6.9.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.E4S:rsync-debuginfo-0:3.1.3-14.el8_6.9.aarch64"
},
"product_reference": "rsync-debuginfo-0:3.1.3-14.el8_6.9.aarch64",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.1.3-14.el8_6.9.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.E4S:rsync-debuginfo-0:3.1.3-14.el8_6.9.ppc64le"
},
"product_reference": "rsync-debuginfo-0:3.1.3-14.el8_6.9.ppc64le",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.1.3-14.el8_6.9.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.E4S:rsync-debuginfo-0:3.1.3-14.el8_6.9.s390x"
},
"product_reference": "rsync-debuginfo-0:3.1.3-14.el8_6.9.s390x",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.E4S:rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64"
},
"product_reference": "rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.1.3-14.el8_6.9.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.E4S:rsync-debugsource-0:3.1.3-14.el8_6.9.aarch64"
},
"product_reference": "rsync-debugsource-0:3.1.3-14.el8_6.9.aarch64",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.1.3-14.el8_6.9.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.E4S:rsync-debugsource-0:3.1.3-14.el8_6.9.ppc64le"
},
"product_reference": "rsync-debugsource-0:3.1.3-14.el8_6.9.ppc64le",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.1.3-14.el8_6.9.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.E4S:rsync-debugsource-0:3.1.3-14.el8_6.9.s390x"
},
"product_reference": "rsync-debugsource-0:3.1.3-14.el8_6.9.s390x",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.E4S:rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64"
},
"product_reference": "rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64",
"relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-14.el8_6.9.src as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.TUS:rsync-0:3.1.3-14.el8_6.9.src"
},
"product_reference": "rsync-0:3.1.3-14.el8_6.9.src",
"relates_to_product_reference": "BaseOS-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-14.el8_6.9.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.TUS:rsync-0:3.1.3-14.el8_6.9.x86_64"
},
"product_reference": "rsync-0:3.1.3-14.el8_6.9.x86_64",
"relates_to_product_reference": "BaseOS-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-daemon-0:3.1.3-14.el8_6.9.noarch as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.TUS:rsync-daemon-0:3.1.3-14.el8_6.9.noarch"
},
"product_reference": "rsync-daemon-0:3.1.3-14.el8_6.9.noarch",
"relates_to_product_reference": "BaseOS-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.TUS:rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64"
},
"product_reference": "rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64",
"relates_to_product_reference": "BaseOS-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.TUS:rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64"
},
"product_reference": "rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64",
"relates_to_product_reference": "BaseOS-8.6.0.Z.TUS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Simon Scannell",
"Pedro Gallegos",
"Jasiel Spelman"
],
"organization": "Google"
}
],
"cve": "CVE-2024-12087",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2024-12-05T21:23:24.139000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2330672"
}
],
"notes": [
{
"category": "description",
"text": "A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client\u0027s intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: Path traversal vulnerability in rsync",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw to have moderate severity as it depends on specific configurations for the attack to succeed, symbolic link syncing must be enabled (explicitly by providing the `--links` option or implicitly such as with `--archive`) and the client must connect to a malicious or compromised server.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"BaseOS-8.6.0.Z.AUS:rsync-0:3.1.3-14.el8_6.9.src",
"BaseOS-8.6.0.Z.AUS:rsync-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.AUS:rsync-daemon-0:3.1.3-14.el8_6.9.noarch",
"BaseOS-8.6.0.Z.AUS:rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.AUS:rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.aarch64",
"BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.ppc64le",
"BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.s390x",
"BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.src",
"BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.E4S:rsync-daemon-0:3.1.3-14.el8_6.9.noarch",
"BaseOS-8.6.0.Z.E4S:rsync-debuginfo-0:3.1.3-14.el8_6.9.aarch64",
"BaseOS-8.6.0.Z.E4S:rsync-debuginfo-0:3.1.3-14.el8_6.9.ppc64le",
"BaseOS-8.6.0.Z.E4S:rsync-debuginfo-0:3.1.3-14.el8_6.9.s390x",
"BaseOS-8.6.0.Z.E4S:rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.E4S:rsync-debugsource-0:3.1.3-14.el8_6.9.aarch64",
"BaseOS-8.6.0.Z.E4S:rsync-debugsource-0:3.1.3-14.el8_6.9.ppc64le",
"BaseOS-8.6.0.Z.E4S:rsync-debugsource-0:3.1.3-14.el8_6.9.s390x",
"BaseOS-8.6.0.Z.E4S:rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.TUS:rsync-0:3.1.3-14.el8_6.9.src",
"BaseOS-8.6.0.Z.TUS:rsync-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.TUS:rsync-daemon-0:3.1.3-14.el8_6.9.noarch",
"BaseOS-8.6.0.Z.TUS:rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.TUS:rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-12087"
},
{
"category": "external",
"summary": "RHBZ#2330672",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330672"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-12087",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12087"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12087",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12087"
},
{
"category": "external",
"summary": "https://kb.cert.org/vuls/id/952657",
"url": "https://kb.cert.org/vuls/id/952657"
}
],
"release_date": "2025-01-14T15:06:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T12:14:03+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"BaseOS-8.6.0.Z.AUS:rsync-0:3.1.3-14.el8_6.9.src",
"BaseOS-8.6.0.Z.AUS:rsync-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.AUS:rsync-daemon-0:3.1.3-14.el8_6.9.noarch",
"BaseOS-8.6.0.Z.AUS:rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.AUS:rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.aarch64",
"BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.ppc64le",
"BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.s390x",
"BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.src",
"BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.E4S:rsync-daemon-0:3.1.3-14.el8_6.9.noarch",
"BaseOS-8.6.0.Z.E4S:rsync-debuginfo-0:3.1.3-14.el8_6.9.aarch64",
"BaseOS-8.6.0.Z.E4S:rsync-debuginfo-0:3.1.3-14.el8_6.9.ppc64le",
"BaseOS-8.6.0.Z.E4S:rsync-debuginfo-0:3.1.3-14.el8_6.9.s390x",
"BaseOS-8.6.0.Z.E4S:rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.E4S:rsync-debugsource-0:3.1.3-14.el8_6.9.aarch64",
"BaseOS-8.6.0.Z.E4S:rsync-debugsource-0:3.1.3-14.el8_6.9.ppc64le",
"BaseOS-8.6.0.Z.E4S:rsync-debugsource-0:3.1.3-14.el8_6.9.s390x",
"BaseOS-8.6.0.Z.E4S:rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.TUS:rsync-0:3.1.3-14.el8_6.9.src",
"BaseOS-8.6.0.Z.TUS:rsync-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.TUS:rsync-daemon-0:3.1.3-14.el8_6.9.noarch",
"BaseOS-8.6.0.Z.TUS:rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.TUS:rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23854"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"BaseOS-8.6.0.Z.AUS:rsync-0:3.1.3-14.el8_6.9.src",
"BaseOS-8.6.0.Z.AUS:rsync-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.AUS:rsync-daemon-0:3.1.3-14.el8_6.9.noarch",
"BaseOS-8.6.0.Z.AUS:rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.AUS:rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.aarch64",
"BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.ppc64le",
"BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.s390x",
"BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.src",
"BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.E4S:rsync-daemon-0:3.1.3-14.el8_6.9.noarch",
"BaseOS-8.6.0.Z.E4S:rsync-debuginfo-0:3.1.3-14.el8_6.9.aarch64",
"BaseOS-8.6.0.Z.E4S:rsync-debuginfo-0:3.1.3-14.el8_6.9.ppc64le",
"BaseOS-8.6.0.Z.E4S:rsync-debuginfo-0:3.1.3-14.el8_6.9.s390x",
"BaseOS-8.6.0.Z.E4S:rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.E4S:rsync-debugsource-0:3.1.3-14.el8_6.9.aarch64",
"BaseOS-8.6.0.Z.E4S:rsync-debugsource-0:3.1.3-14.el8_6.9.ppc64le",
"BaseOS-8.6.0.Z.E4S:rsync-debugsource-0:3.1.3-14.el8_6.9.s390x",
"BaseOS-8.6.0.Z.E4S:rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.TUS:rsync-0:3.1.3-14.el8_6.9.src",
"BaseOS-8.6.0.Z.TUS:rsync-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.TUS:rsync-daemon-0:3.1.3-14.el8_6.9.noarch",
"BaseOS-8.6.0.Z.TUS:rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.TUS:rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"BaseOS-8.6.0.Z.AUS:rsync-0:3.1.3-14.el8_6.9.src",
"BaseOS-8.6.0.Z.AUS:rsync-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.AUS:rsync-daemon-0:3.1.3-14.el8_6.9.noarch",
"BaseOS-8.6.0.Z.AUS:rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.AUS:rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.aarch64",
"BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.ppc64le",
"BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.s390x",
"BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.src",
"BaseOS-8.6.0.Z.E4S:rsync-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.E4S:rsync-daemon-0:3.1.3-14.el8_6.9.noarch",
"BaseOS-8.6.0.Z.E4S:rsync-debuginfo-0:3.1.3-14.el8_6.9.aarch64",
"BaseOS-8.6.0.Z.E4S:rsync-debuginfo-0:3.1.3-14.el8_6.9.ppc64le",
"BaseOS-8.6.0.Z.E4S:rsync-debuginfo-0:3.1.3-14.el8_6.9.s390x",
"BaseOS-8.6.0.Z.E4S:rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.E4S:rsync-debugsource-0:3.1.3-14.el8_6.9.aarch64",
"BaseOS-8.6.0.Z.E4S:rsync-debugsource-0:3.1.3-14.el8_6.9.ppc64le",
"BaseOS-8.6.0.Z.E4S:rsync-debugsource-0:3.1.3-14.el8_6.9.s390x",
"BaseOS-8.6.0.Z.E4S:rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.TUS:rsync-0:3.1.3-14.el8_6.9.src",
"BaseOS-8.6.0.Z.TUS:rsync-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.TUS:rsync-daemon-0:3.1.3-14.el8_6.9.noarch",
"BaseOS-8.6.0.Z.TUS:rsync-debuginfo-0:3.1.3-14.el8_6.9.x86_64",
"BaseOS-8.6.0.Z.TUS:rsync-debugsource-0:3.1.3-14.el8_6.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsync: Path traversal vulnerability in rsync"
}
]
}
RHSA-2025:23858
Vulnerability from csaf_redhat - Published: 2025-12-22 12:57 - Updated: 2026-04-14 21:41Summary
Red Hat Security Advisory: rsync security update
Severity
Moderate
Notes
Topic: An update for rsync is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.
Security Fix(es):
* rsync: Path traversal vulnerability in rsync (CVE-2024-12087)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.
6.5 (Medium)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: BaseOS-8.8.0.Z.E4S:rsync-0:3.1.3-20.el8_8.4.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S:rsync-0:3.1.3-20.el8_8.4.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S:rsync-0:3.1.3-20.el8_8.4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S:rsync-daemon-0:3.1.3-20.el8_8.4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S:rsync-debuginfo-0:3.1.3-20.el8_8.4.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S:rsync-debuginfo-0:3.1.3-20.el8_8.4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S:rsync-debugsource-0:3.1.3-20.el8_8.4.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.E4S:rsync-debugsource-0:3.1.3-20.el8_8.4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.TUS:rsync-0:3.1.3-20.el8_8.4.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.TUS:rsync-0:3.1.3-20.el8_8.4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.TUS:rsync-daemon-0:3.1.3-20.el8_8.4.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.TUS:rsync-debuginfo-0:3.1.3-20.el8_8.4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.8.0.Z.TUS:rsync-debugsource-0:3.1.3-20.el8_8.4.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
References
9 references
Acknowledgments
Google
Simon Scannell
Pedro Gallegos
Jasiel Spelman
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for rsync is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: Path traversal vulnerability in rsync (CVE-2024-12087)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:23858",
"url": "https://access.redhat.com/errata/RHSA-2025:23858"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "2330672",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330672"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23858.json"
}
],
"title": "Red Hat Security Advisory: rsync security update",
"tracking": {
"current_release_date": "2026-04-14T21:41:52+00:00",
"generator": {
"date": "2026-04-14T21:41:52+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.5"
}
},
"id": "RHSA-2025:23858",
"initial_release_date": "2025-12-22T12:57:18+00:00",
"revision_history": [
{
"date": "2025-12-22T12:57:18+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-12-22T12:57:18+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-04-14T21:41:52+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux BaseOS E4S (v.8.8)",
"product": {
"name": "Red Hat Enterprise Linux BaseOS E4S (v.8.8)",
"product_id": "BaseOS-8.8.0.Z.E4S",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_e4s:8.8::baseos"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux BaseOS TUS (v.8.8)",
"product": {
"name": "Red Hat Enterprise Linux BaseOS TUS (v.8.8)",
"product_id": "BaseOS-8.8.0.Z.TUS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_tus:8.8::baseos"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.1.3-20.el8_8.4.x86_64",
"product": {
"name": "rsync-0:3.1.3-20.el8_8.4.x86_64",
"product_id": "rsync-0:3.1.3-20.el8_8.4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.1.3-20.el8_8.4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rsync-debugsource-0:3.1.3-20.el8_8.4.x86_64",
"product": {
"name": "rsync-debugsource-0:3.1.3-20.el8_8.4.x86_64",
"product_id": "rsync-debugsource-0:3.1.3-20.el8_8.4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debugsource@3.1.3-20.el8_8.4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rsync-debuginfo-0:3.1.3-20.el8_8.4.x86_64",
"product": {
"name": "rsync-debuginfo-0:3.1.3-20.el8_8.4.x86_64",
"product_id": "rsync-debuginfo-0:3.1.3-20.el8_8.4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debuginfo@3.1.3-20.el8_8.4?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.1.3-20.el8_8.4.src",
"product": {
"name": "rsync-0:3.1.3-20.el8_8.4.src",
"product_id": "rsync-0:3.1.3-20.el8_8.4.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.1.3-20.el8_8.4?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.1.3-20.el8_8.4.ppc64le",
"product": {
"name": "rsync-0:3.1.3-20.el8_8.4.ppc64le",
"product_id": "rsync-0:3.1.3-20.el8_8.4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.1.3-20.el8_8.4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "rsync-debugsource-0:3.1.3-20.el8_8.4.ppc64le",
"product": {
"name": "rsync-debugsource-0:3.1.3-20.el8_8.4.ppc64le",
"product_id": "rsync-debugsource-0:3.1.3-20.el8_8.4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debugsource@3.1.3-20.el8_8.4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "rsync-debuginfo-0:3.1.3-20.el8_8.4.ppc64le",
"product": {
"name": "rsync-debuginfo-0:3.1.3-20.el8_8.4.ppc64le",
"product_id": "rsync-debuginfo-0:3.1.3-20.el8_8.4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debuginfo@3.1.3-20.el8_8.4?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-daemon-0:3.1.3-20.el8_8.4.noarch",
"product": {
"name": "rsync-daemon-0:3.1.3-20.el8_8.4.noarch",
"product_id": "rsync-daemon-0:3.1.3-20.el8_8.4.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-daemon@3.1.3-20.el8_8.4?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-20.el8_8.4.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)",
"product_id": "BaseOS-8.8.0.Z.E4S:rsync-0:3.1.3-20.el8_8.4.ppc64le"
},
"product_reference": "rsync-0:3.1.3-20.el8_8.4.ppc64le",
"relates_to_product_reference": "BaseOS-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-20.el8_8.4.src as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)",
"product_id": "BaseOS-8.8.0.Z.E4S:rsync-0:3.1.3-20.el8_8.4.src"
},
"product_reference": "rsync-0:3.1.3-20.el8_8.4.src",
"relates_to_product_reference": "BaseOS-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-20.el8_8.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)",
"product_id": "BaseOS-8.8.0.Z.E4S:rsync-0:3.1.3-20.el8_8.4.x86_64"
},
"product_reference": "rsync-0:3.1.3-20.el8_8.4.x86_64",
"relates_to_product_reference": "BaseOS-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-daemon-0:3.1.3-20.el8_8.4.noarch as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)",
"product_id": "BaseOS-8.8.0.Z.E4S:rsync-daemon-0:3.1.3-20.el8_8.4.noarch"
},
"product_reference": "rsync-daemon-0:3.1.3-20.el8_8.4.noarch",
"relates_to_product_reference": "BaseOS-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.1.3-20.el8_8.4.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)",
"product_id": "BaseOS-8.8.0.Z.E4S:rsync-debuginfo-0:3.1.3-20.el8_8.4.ppc64le"
},
"product_reference": "rsync-debuginfo-0:3.1.3-20.el8_8.4.ppc64le",
"relates_to_product_reference": "BaseOS-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.1.3-20.el8_8.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)",
"product_id": "BaseOS-8.8.0.Z.E4S:rsync-debuginfo-0:3.1.3-20.el8_8.4.x86_64"
},
"product_reference": "rsync-debuginfo-0:3.1.3-20.el8_8.4.x86_64",
"relates_to_product_reference": "BaseOS-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.1.3-20.el8_8.4.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)",
"product_id": "BaseOS-8.8.0.Z.E4S:rsync-debugsource-0:3.1.3-20.el8_8.4.ppc64le"
},
"product_reference": "rsync-debugsource-0:3.1.3-20.el8_8.4.ppc64le",
"relates_to_product_reference": "BaseOS-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.1.3-20.el8_8.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)",
"product_id": "BaseOS-8.8.0.Z.E4S:rsync-debugsource-0:3.1.3-20.el8_8.4.x86_64"
},
"product_reference": "rsync-debugsource-0:3.1.3-20.el8_8.4.x86_64",
"relates_to_product_reference": "BaseOS-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-20.el8_8.4.src as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)",
"product_id": "BaseOS-8.8.0.Z.TUS:rsync-0:3.1.3-20.el8_8.4.src"
},
"product_reference": "rsync-0:3.1.3-20.el8_8.4.src",
"relates_to_product_reference": "BaseOS-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-20.el8_8.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)",
"product_id": "BaseOS-8.8.0.Z.TUS:rsync-0:3.1.3-20.el8_8.4.x86_64"
},
"product_reference": "rsync-0:3.1.3-20.el8_8.4.x86_64",
"relates_to_product_reference": "BaseOS-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-daemon-0:3.1.3-20.el8_8.4.noarch as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)",
"product_id": "BaseOS-8.8.0.Z.TUS:rsync-daemon-0:3.1.3-20.el8_8.4.noarch"
},
"product_reference": "rsync-daemon-0:3.1.3-20.el8_8.4.noarch",
"relates_to_product_reference": "BaseOS-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.1.3-20.el8_8.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)",
"product_id": "BaseOS-8.8.0.Z.TUS:rsync-debuginfo-0:3.1.3-20.el8_8.4.x86_64"
},
"product_reference": "rsync-debuginfo-0:3.1.3-20.el8_8.4.x86_64",
"relates_to_product_reference": "BaseOS-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.1.3-20.el8_8.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)",
"product_id": "BaseOS-8.8.0.Z.TUS:rsync-debugsource-0:3.1.3-20.el8_8.4.x86_64"
},
"product_reference": "rsync-debugsource-0:3.1.3-20.el8_8.4.x86_64",
"relates_to_product_reference": "BaseOS-8.8.0.Z.TUS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Simon Scannell",
"Pedro Gallegos",
"Jasiel Spelman"
],
"organization": "Google"
}
],
"cve": "CVE-2024-12087",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2024-12-05T21:23:24.139000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2330672"
}
],
"notes": [
{
"category": "description",
"text": "A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client\u0027s intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: Path traversal vulnerability in rsync",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw to have moderate severity as it depends on specific configurations for the attack to succeed, symbolic link syncing must be enabled (explicitly by providing the `--links` option or implicitly such as with `--archive`) and the client must connect to a malicious or compromised server.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"BaseOS-8.8.0.Z.E4S:rsync-0:3.1.3-20.el8_8.4.ppc64le",
"BaseOS-8.8.0.Z.E4S:rsync-0:3.1.3-20.el8_8.4.src",
"BaseOS-8.8.0.Z.E4S:rsync-0:3.1.3-20.el8_8.4.x86_64",
"BaseOS-8.8.0.Z.E4S:rsync-daemon-0:3.1.3-20.el8_8.4.noarch",
"BaseOS-8.8.0.Z.E4S:rsync-debuginfo-0:3.1.3-20.el8_8.4.ppc64le",
"BaseOS-8.8.0.Z.E4S:rsync-debuginfo-0:3.1.3-20.el8_8.4.x86_64",
"BaseOS-8.8.0.Z.E4S:rsync-debugsource-0:3.1.3-20.el8_8.4.ppc64le",
"BaseOS-8.8.0.Z.E4S:rsync-debugsource-0:3.1.3-20.el8_8.4.x86_64",
"BaseOS-8.8.0.Z.TUS:rsync-0:3.1.3-20.el8_8.4.src",
"BaseOS-8.8.0.Z.TUS:rsync-0:3.1.3-20.el8_8.4.x86_64",
"BaseOS-8.8.0.Z.TUS:rsync-daemon-0:3.1.3-20.el8_8.4.noarch",
"BaseOS-8.8.0.Z.TUS:rsync-debuginfo-0:3.1.3-20.el8_8.4.x86_64",
"BaseOS-8.8.0.Z.TUS:rsync-debugsource-0:3.1.3-20.el8_8.4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-12087"
},
{
"category": "external",
"summary": "RHBZ#2330672",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330672"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-12087",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12087"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12087",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12087"
},
{
"category": "external",
"summary": "https://kb.cert.org/vuls/id/952657",
"url": "https://kb.cert.org/vuls/id/952657"
}
],
"release_date": "2025-01-14T15:06:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T12:57:18+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"BaseOS-8.8.0.Z.E4S:rsync-0:3.1.3-20.el8_8.4.ppc64le",
"BaseOS-8.8.0.Z.E4S:rsync-0:3.1.3-20.el8_8.4.src",
"BaseOS-8.8.0.Z.E4S:rsync-0:3.1.3-20.el8_8.4.x86_64",
"BaseOS-8.8.0.Z.E4S:rsync-daemon-0:3.1.3-20.el8_8.4.noarch",
"BaseOS-8.8.0.Z.E4S:rsync-debuginfo-0:3.1.3-20.el8_8.4.ppc64le",
"BaseOS-8.8.0.Z.E4S:rsync-debuginfo-0:3.1.3-20.el8_8.4.x86_64",
"BaseOS-8.8.0.Z.E4S:rsync-debugsource-0:3.1.3-20.el8_8.4.ppc64le",
"BaseOS-8.8.0.Z.E4S:rsync-debugsource-0:3.1.3-20.el8_8.4.x86_64",
"BaseOS-8.8.0.Z.TUS:rsync-0:3.1.3-20.el8_8.4.src",
"BaseOS-8.8.0.Z.TUS:rsync-0:3.1.3-20.el8_8.4.x86_64",
"BaseOS-8.8.0.Z.TUS:rsync-daemon-0:3.1.3-20.el8_8.4.noarch",
"BaseOS-8.8.0.Z.TUS:rsync-debuginfo-0:3.1.3-20.el8_8.4.x86_64",
"BaseOS-8.8.0.Z.TUS:rsync-debugsource-0:3.1.3-20.el8_8.4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23858"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"BaseOS-8.8.0.Z.E4S:rsync-0:3.1.3-20.el8_8.4.ppc64le",
"BaseOS-8.8.0.Z.E4S:rsync-0:3.1.3-20.el8_8.4.src",
"BaseOS-8.8.0.Z.E4S:rsync-0:3.1.3-20.el8_8.4.x86_64",
"BaseOS-8.8.0.Z.E4S:rsync-daemon-0:3.1.3-20.el8_8.4.noarch",
"BaseOS-8.8.0.Z.E4S:rsync-debuginfo-0:3.1.3-20.el8_8.4.ppc64le",
"BaseOS-8.8.0.Z.E4S:rsync-debuginfo-0:3.1.3-20.el8_8.4.x86_64",
"BaseOS-8.8.0.Z.E4S:rsync-debugsource-0:3.1.3-20.el8_8.4.ppc64le",
"BaseOS-8.8.0.Z.E4S:rsync-debugsource-0:3.1.3-20.el8_8.4.x86_64",
"BaseOS-8.8.0.Z.TUS:rsync-0:3.1.3-20.el8_8.4.src",
"BaseOS-8.8.0.Z.TUS:rsync-0:3.1.3-20.el8_8.4.x86_64",
"BaseOS-8.8.0.Z.TUS:rsync-daemon-0:3.1.3-20.el8_8.4.noarch",
"BaseOS-8.8.0.Z.TUS:rsync-debuginfo-0:3.1.3-20.el8_8.4.x86_64",
"BaseOS-8.8.0.Z.TUS:rsync-debugsource-0:3.1.3-20.el8_8.4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"BaseOS-8.8.0.Z.E4S:rsync-0:3.1.3-20.el8_8.4.ppc64le",
"BaseOS-8.8.0.Z.E4S:rsync-0:3.1.3-20.el8_8.4.src",
"BaseOS-8.8.0.Z.E4S:rsync-0:3.1.3-20.el8_8.4.x86_64",
"BaseOS-8.8.0.Z.E4S:rsync-daemon-0:3.1.3-20.el8_8.4.noarch",
"BaseOS-8.8.0.Z.E4S:rsync-debuginfo-0:3.1.3-20.el8_8.4.ppc64le",
"BaseOS-8.8.0.Z.E4S:rsync-debuginfo-0:3.1.3-20.el8_8.4.x86_64",
"BaseOS-8.8.0.Z.E4S:rsync-debugsource-0:3.1.3-20.el8_8.4.ppc64le",
"BaseOS-8.8.0.Z.E4S:rsync-debugsource-0:3.1.3-20.el8_8.4.x86_64",
"BaseOS-8.8.0.Z.TUS:rsync-0:3.1.3-20.el8_8.4.src",
"BaseOS-8.8.0.Z.TUS:rsync-0:3.1.3-20.el8_8.4.x86_64",
"BaseOS-8.8.0.Z.TUS:rsync-daemon-0:3.1.3-20.el8_8.4.noarch",
"BaseOS-8.8.0.Z.TUS:rsync-debuginfo-0:3.1.3-20.el8_8.4.x86_64",
"BaseOS-8.8.0.Z.TUS:rsync-debugsource-0:3.1.3-20.el8_8.4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsync: Path traversal vulnerability in rsync"
}
]
}
RHSA-2025:2600
Vulnerability from csaf_redhat - Published: 2025-03-11 00:23 - Updated: 2026-04-14 21:41Summary
Red Hat Security Advisory: rsync security update
Severity
Moderate
Notes
Topic: An update for rsync is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.
Security Fix(es):
* rsync: Path traversal vulnerability in rsync (CVE-2024-12087)
* rsync: --safe-links option bypass leads to path traversal (CVE-2024-12088)
* rsync: Race Condition in rsync Handling Symbolic Links (CVE-2024-12747)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.
6.5 (Medium)
Affected products
Fixed
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.
6.5 (Medium)
Affected products
Fixed
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.
5.6 (Medium)
Affected products
Fixed
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
References
19 references
Acknowledgments
Google
Simon Scannell
Pedro Gallegos
Jasiel Spelman
Google
Simon Scannell
Jasiel Spelman
Pedro Gallegos
Aleksei Gorban "loqpa"
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for rsync is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: Path traversal vulnerability in rsync (CVE-2024-12087)\n\n* rsync: --safe-links option bypass leads to path traversal (CVE-2024-12088)\n\n* rsync: Race Condition in rsync Handling Symbolic Links (CVE-2024-12747)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:2600",
"url": "https://access.redhat.com/errata/RHSA-2025:2600"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "2330672",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330672"
},
{
"category": "external",
"summary": "2330676",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330676"
},
{
"category": "external",
"summary": "2332968",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2332968"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2600.json"
}
],
"title": "Red Hat Security Advisory: rsync security update",
"tracking": {
"current_release_date": "2026-04-14T21:41:52+00:00",
"generator": {
"date": "2026-04-14T21:41:52+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.5"
}
},
"id": "RHSA-2025:2600",
"initial_release_date": "2025-03-11T00:23:51+00:00",
"revision_history": [
{
"date": "2025-03-11T00:23:51+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-03-11T00:23:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-04-14T21:41:52+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux BaseOS (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:8::baseos"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.1.3-21.el8_10.src",
"product": {
"name": "rsync-0:3.1.3-21.el8_10.src",
"product_id": "rsync-0:3.1.3-21.el8_10.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.1.3-21.el8_10?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.1.3-21.el8_10.aarch64",
"product": {
"name": "rsync-0:3.1.3-21.el8_10.aarch64",
"product_id": "rsync-0:3.1.3-21.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.1.3-21.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
"product": {
"name": "rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
"product_id": "rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debugsource@3.1.3-21.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
"product": {
"name": "rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
"product_id": "rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debuginfo@3.1.3-21.el8_10?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.1.3-21.el8_10.ppc64le",
"product": {
"name": "rsync-0:3.1.3-21.el8_10.ppc64le",
"product_id": "rsync-0:3.1.3-21.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.1.3-21.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
"product": {
"name": "rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
"product_id": "rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debugsource@3.1.3-21.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
"product": {
"name": "rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
"product_id": "rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debuginfo@3.1.3-21.el8_10?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.1.3-21.el8_10.x86_64",
"product": {
"name": "rsync-0:3.1.3-21.el8_10.x86_64",
"product_id": "rsync-0:3.1.3-21.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.1.3-21.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
"product": {
"name": "rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
"product_id": "rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debugsource@3.1.3-21.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
"product": {
"name": "rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
"product_id": "rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debuginfo@3.1.3-21.el8_10?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.1.3-21.el8_10.s390x",
"product": {
"name": "rsync-0:3.1.3-21.el8_10.s390x",
"product_id": "rsync-0:3.1.3-21.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.1.3-21.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "rsync-debugsource-0:3.1.3-21.el8_10.s390x",
"product": {
"name": "rsync-debugsource-0:3.1.3-21.el8_10.s390x",
"product_id": "rsync-debugsource-0:3.1.3-21.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debugsource@3.1.3-21.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
"product": {
"name": "rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
"product_id": "rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debuginfo@3.1.3-21.el8_10?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-daemon-0:3.1.3-21.el8_10.noarch",
"product": {
"name": "rsync-daemon-0:3.1.3-21.el8_10.noarch",
"product_id": "rsync-daemon-0:3.1.3-21.el8_10.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-daemon@3.1.3-21.el8_10?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-21.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64"
},
"product_reference": "rsync-0:3.1.3-21.el8_10.aarch64",
"relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-21.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le"
},
"product_reference": "rsync-0:3.1.3-21.el8_10.ppc64le",
"relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-21.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x"
},
"product_reference": "rsync-0:3.1.3-21.el8_10.s390x",
"relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-21.el8_10.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src"
},
"product_reference": "rsync-0:3.1.3-21.el8_10.src",
"relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.1.3-21.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64"
},
"product_reference": "rsync-0:3.1.3-21.el8_10.x86_64",
"relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-daemon-0:3.1.3-21.el8_10.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch"
},
"product_reference": "rsync-daemon-0:3.1.3-21.el8_10.noarch",
"relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.1.3-21.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64"
},
"product_reference": "rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
"relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le"
},
"product_reference": "rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
"relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.1.3-21.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x"
},
"product_reference": "rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
"relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.1.3-21.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64"
},
"product_reference": "rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
"relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.1.3-21.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64"
},
"product_reference": "rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
"relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.1.3-21.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le"
},
"product_reference": "rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
"relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.1.3-21.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x"
},
"product_reference": "rsync-debugsource-0:3.1.3-21.el8_10.s390x",
"relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.1.3-21.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
},
"product_reference": "rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
"relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Simon Scannell",
"Pedro Gallegos",
"Jasiel Spelman"
],
"organization": "Google"
}
],
"cve": "CVE-2024-12087",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2024-12-05T21:23:24.139000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2330672"
}
],
"notes": [
{
"category": "description",
"text": "A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client\u0027s intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: Path traversal vulnerability in rsync",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw to have moderate severity as it depends on specific configurations for the attack to succeed, symbolic link syncing must be enabled (explicitly by providing the `--links` option or implicitly such as with `--archive`) and the client must connect to a malicious or compromised server.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-12087"
},
{
"category": "external",
"summary": "RHBZ#2330672",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330672"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-12087",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12087"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12087",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12087"
},
{
"category": "external",
"summary": "https://kb.cert.org/vuls/id/952657",
"url": "https://kb.cert.org/vuls/id/952657"
}
],
"release_date": "2025-01-14T15:06:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-03-11T00:23:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:2600"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsync: Path traversal vulnerability in rsync"
},
{
"acknowledgments": [
{
"names": [
"Simon Scannell",
"Jasiel Spelman",
"Pedro Gallegos"
],
"organization": "Google"
}
],
"cve": "CVE-2024-12088",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2024-12-05T21:55:22.700000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2330676"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: --safe-links option bypass leads to path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The vulnerability requires user interaction to be triggered, as the rsync client must first establish a connection/have access to the malicious rsync server (at least anonymous read-access).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-12088"
},
{
"category": "external",
"summary": "RHBZ#2330676",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330676"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-12088",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12088"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12088",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12088"
},
{
"category": "external",
"summary": "https://kb.cert.org/vuls/id/952657",
"url": "https://kb.cert.org/vuls/id/952657"
}
],
"release_date": "2025-01-14T15:06:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-03-11T00:23:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:2600"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsync: --safe-links option bypass leads to path traversal"
},
{
"acknowledgments": [
{
"names": [
"Aleksei Gorban \"loqpa\""
]
}
],
"cve": "CVE-2024-12747",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"discovery_date": "2024-12-18T07:12:52.493000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2332968"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. This vulnerability arises from a race condition during rsync\u0027s handling of symbolic links. Rsync\u0027s default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: Race Condition in rsync Handling Symbolic Links",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-12747"
},
{
"category": "external",
"summary": "RHBZ#2332968",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2332968"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-12747",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12747"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12747",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12747"
},
{
"category": "external",
"summary": "https://kb.cert.org/vuls/id/952657",
"url": "https://kb.cert.org/vuls/id/952657"
}
],
"release_date": "2025-01-14T15:06:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-03-11T00:23:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:2600"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
"BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsync: Race Condition in rsync Handling Symbolic Links"
}
]
}
RHSA-2025:7050
Vulnerability from csaf_redhat - Published: 2025-05-13 09:04 - Updated: 2026-04-14 21:41Summary
Red Hat Security Advisory: rsync security update
Severity
Moderate
Notes
Topic: An update for rsync is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.
Security Fix(es):
* rsync: Path traversal vulnerability in rsync (CVE-2024-12087)
* rsync: --safe-links option bypass leads to path traversal (CVE-2024-12088)
* rsync: Race Condition in rsync Handling Symbolic Links (CVE-2024-12747)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.
6.5 (Medium)
Affected products
Fixed
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.
6.5 (Medium)
Affected products
Fixed
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.
5.6 (Medium)
Affected products
Fixed
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
References
23 references
Acknowledgments
Google
Simon Scannell
Pedro Gallegos
Jasiel Spelman
Google
Simon Scannell
Jasiel Spelman
Pedro Gallegos
Aleksei Gorban "loqpa"
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for rsync is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: Path traversal vulnerability in rsync (CVE-2024-12087)\n\n* rsync: --safe-links option bypass leads to path traversal (CVE-2024-12088)\n\n* rsync: Race Condition in rsync Handling Symbolic Links (CVE-2024-12747)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:7050",
"url": "https://access.redhat.com/errata/RHSA-2025:7050"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.6_release_notes/index",
"url": "https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.6_release_notes/index"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "2330672",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330672"
},
{
"category": "external",
"summary": "2330676",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330676"
},
{
"category": "external",
"summary": "2332968",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2332968"
},
{
"category": "external",
"summary": "RHEL-18216",
"url": "https://issues.redhat.com/browse/RHEL-18216"
},
{
"category": "external",
"summary": "RHEL-67142",
"url": "https://issues.redhat.com/browse/RHEL-67142"
},
{
"category": "external",
"summary": "RHEL-70265",
"url": "https://issues.redhat.com/browse/RHEL-70265"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7050.json"
}
],
"title": "Red Hat Security Advisory: rsync security update",
"tracking": {
"current_release_date": "2026-04-14T21:41:52+00:00",
"generator": {
"date": "2026-04-14T21:41:52+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.5"
}
},
"id": "RHSA-2025:7050",
"initial_release_date": "2025-05-13T09:04:13+00:00",
"revision_history": [
{
"date": "2025-05-13T09:04:13+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-05-13T09:04:13+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-04-14T21:41:52+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.GA",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux BaseOS (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.6.0.GA",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:9::baseos"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-daemon-0:3.2.5-3.el9.noarch",
"product": {
"name": "rsync-daemon-0:3.2.5-3.el9.noarch",
"product_id": "rsync-daemon-0:3.2.5-3.el9.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-daemon@3.2.5-3.el9?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rsync-rrsync-0:3.2.5-3.el9.noarch",
"product": {
"name": "rsync-rrsync-0:3.2.5-3.el9.noarch",
"product_id": "rsync-rrsync-0:3.2.5-3.el9.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-rrsync@3.2.5-3.el9?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.2.5-3.el9.src",
"product": {
"name": "rsync-0:3.2.5-3.el9.src",
"product_id": "rsync-0:3.2.5-3.el9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.2.5-3.el9?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.2.5-3.el9.aarch64",
"product": {
"name": "rsync-0:3.2.5-3.el9.aarch64",
"product_id": "rsync-0:3.2.5-3.el9.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.2.5-3.el9?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "rsync-debugsource-0:3.2.5-3.el9.aarch64",
"product": {
"name": "rsync-debugsource-0:3.2.5-3.el9.aarch64",
"product_id": "rsync-debugsource-0:3.2.5-3.el9.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debugsource@3.2.5-3.el9?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"product": {
"name": "rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"product_id": "rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debuginfo@3.2.5-3.el9?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.2.5-3.el9.ppc64le",
"product": {
"name": "rsync-0:3.2.5-3.el9.ppc64le",
"product_id": "rsync-0:3.2.5-3.el9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.2.5-3.el9?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"product": {
"name": "rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"product_id": "rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debugsource@3.2.5-3.el9?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"product": {
"name": "rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"product_id": "rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debuginfo@3.2.5-3.el9?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.2.5-3.el9.x86_64",
"product": {
"name": "rsync-0:3.2.5-3.el9.x86_64",
"product_id": "rsync-0:3.2.5-3.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.2.5-3.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rsync-debugsource-0:3.2.5-3.el9.x86_64",
"product": {
"name": "rsync-debugsource-0:3.2.5-3.el9.x86_64",
"product_id": "rsync-debugsource-0:3.2.5-3.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debugsource@3.2.5-3.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"product": {
"name": "rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"product_id": "rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debuginfo@3.2.5-3.el9?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.2.5-3.el9.s390x",
"product": {
"name": "rsync-0:3.2.5-3.el9.s390x",
"product_id": "rsync-0:3.2.5-3.el9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.2.5-3.el9?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "rsync-debugsource-0:3.2.5-3.el9.s390x",
"product": {
"name": "rsync-debugsource-0:3.2.5-3.el9.s390x",
"product_id": "rsync-debugsource-0:3.2.5-3.el9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debugsource@3.2.5-3.el9?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "rsync-debuginfo-0:3.2.5-3.el9.s390x",
"product": {
"name": "rsync-debuginfo-0:3.2.5-3.el9.s390x",
"product_id": "rsync-debuginfo-0:3.2.5-3.el9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debuginfo@3.2.5-3.el9?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.2.5-3.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64"
},
"product_reference": "rsync-0:3.2.5-3.el9.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.2.5-3.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le"
},
"product_reference": "rsync-0:3.2.5-3.el9.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.2.5-3.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x"
},
"product_reference": "rsync-0:3.2.5-3.el9.s390x",
"relates_to_product_reference": "AppStream-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.2.5-3.el9.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.src"
},
"product_reference": "rsync-0:3.2.5-3.el9.src",
"relates_to_product_reference": "AppStream-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.2.5-3.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64"
},
"product_reference": "rsync-0:3.2.5-3.el9.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-daemon-0:3.2.5-3.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch"
},
"product_reference": "rsync-daemon-0:3.2.5-3.el9.noarch",
"relates_to_product_reference": "AppStream-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.2.5-3.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64"
},
"product_reference": "rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.2.5-3.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le"
},
"product_reference": "rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.2.5-3.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x"
},
"product_reference": "rsync-debuginfo-0:3.2.5-3.el9.s390x",
"relates_to_product_reference": "AppStream-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.2.5-3.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64"
},
"product_reference": "rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.2.5-3.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64"
},
"product_reference": "rsync-debugsource-0:3.2.5-3.el9.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.2.5-3.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le"
},
"product_reference": "rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.2.5-3.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x"
},
"product_reference": "rsync-debugsource-0:3.2.5-3.el9.s390x",
"relates_to_product_reference": "AppStream-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.2.5-3.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64"
},
"product_reference": "rsync-debugsource-0:3.2.5-3.el9.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-rrsync-0:3.2.5-3.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch"
},
"product_reference": "rsync-rrsync-0:3.2.5-3.el9.noarch",
"relates_to_product_reference": "AppStream-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.2.5-3.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64"
},
"product_reference": "rsync-0:3.2.5-3.el9.aarch64",
"relates_to_product_reference": "BaseOS-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.2.5-3.el9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le"
},
"product_reference": "rsync-0:3.2.5-3.el9.ppc64le",
"relates_to_product_reference": "BaseOS-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.2.5-3.el9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x"
},
"product_reference": "rsync-0:3.2.5-3.el9.s390x",
"relates_to_product_reference": "BaseOS-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.2.5-3.el9.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.src"
},
"product_reference": "rsync-0:3.2.5-3.el9.src",
"relates_to_product_reference": "BaseOS-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.2.5-3.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64"
},
"product_reference": "rsync-0:3.2.5-3.el9.x86_64",
"relates_to_product_reference": "BaseOS-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-daemon-0:3.2.5-3.el9.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch"
},
"product_reference": "rsync-daemon-0:3.2.5-3.el9.noarch",
"relates_to_product_reference": "BaseOS-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.2.5-3.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64"
},
"product_reference": "rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"relates_to_product_reference": "BaseOS-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.2.5-3.el9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le"
},
"product_reference": "rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"relates_to_product_reference": "BaseOS-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.2.5-3.el9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x"
},
"product_reference": "rsync-debuginfo-0:3.2.5-3.el9.s390x",
"relates_to_product_reference": "BaseOS-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.2.5-3.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64"
},
"product_reference": "rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"relates_to_product_reference": "BaseOS-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.2.5-3.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64"
},
"product_reference": "rsync-debugsource-0:3.2.5-3.el9.aarch64",
"relates_to_product_reference": "BaseOS-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.2.5-3.el9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le"
},
"product_reference": "rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"relates_to_product_reference": "BaseOS-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.2.5-3.el9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x"
},
"product_reference": "rsync-debugsource-0:3.2.5-3.el9.s390x",
"relates_to_product_reference": "BaseOS-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.2.5-3.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64"
},
"product_reference": "rsync-debugsource-0:3.2.5-3.el9.x86_64",
"relates_to_product_reference": "BaseOS-9.6.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-rrsync-0:3.2.5-3.el9.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch"
},
"product_reference": "rsync-rrsync-0:3.2.5-3.el9.noarch",
"relates_to_product_reference": "BaseOS-9.6.0.GA"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Simon Scannell",
"Pedro Gallegos",
"Jasiel Spelman"
],
"organization": "Google"
}
],
"cve": "CVE-2024-12087",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2024-12-05T21:23:24.139000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2330672"
}
],
"notes": [
{
"category": "description",
"text": "A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client\u0027s intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: Path traversal vulnerability in rsync",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw to have moderate severity as it depends on specific configurations for the attack to succeed, symbolic link syncing must be enabled (explicitly by providing the `--links` option or implicitly such as with `--archive`) and the client must connect to a malicious or compromised server.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.src",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.src",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-12087"
},
{
"category": "external",
"summary": "RHBZ#2330672",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330672"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-12087",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12087"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12087",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12087"
},
{
"category": "external",
"summary": "https://kb.cert.org/vuls/id/952657",
"url": "https://kb.cert.org/vuls/id/952657"
}
],
"release_date": "2025-01-14T15:06:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T09:04:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.src",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.src",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7050"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.src",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.src",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.src",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.src",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsync: Path traversal vulnerability in rsync"
},
{
"acknowledgments": [
{
"names": [
"Simon Scannell",
"Jasiel Spelman",
"Pedro Gallegos"
],
"organization": "Google"
}
],
"cve": "CVE-2024-12088",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2024-12-05T21:55:22.700000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2330676"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: --safe-links option bypass leads to path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The vulnerability requires user interaction to be triggered, as the rsync client must first establish a connection/have access to the malicious rsync server (at least anonymous read-access).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.src",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.src",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-12088"
},
{
"category": "external",
"summary": "RHBZ#2330676",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330676"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-12088",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12088"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12088",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12088"
},
{
"category": "external",
"summary": "https://kb.cert.org/vuls/id/952657",
"url": "https://kb.cert.org/vuls/id/952657"
}
],
"release_date": "2025-01-14T15:06:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T09:04:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.src",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.src",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7050"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.src",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.src",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.src",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.src",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsync: --safe-links option bypass leads to path traversal"
},
{
"acknowledgments": [
{
"names": [
"Aleksei Gorban \"loqpa\""
]
}
],
"cve": "CVE-2024-12747",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"discovery_date": "2024-12-18T07:12:52.493000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2332968"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. This vulnerability arises from a race condition during rsync\u0027s handling of symbolic links. Rsync\u0027s default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: Race Condition in rsync Handling Symbolic Links",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.src",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.src",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-12747"
},
{
"category": "external",
"summary": "RHBZ#2332968",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2332968"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-12747",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12747"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12747",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12747"
},
{
"category": "external",
"summary": "https://kb.cert.org/vuls/id/952657",
"url": "https://kb.cert.org/vuls/id/952657"
}
],
"release_date": "2025-01-14T15:06:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T09:04:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.src",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.src",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7050"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.src",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.src",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.src",
"AppStream-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x",
"AppStream-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64",
"AppStream-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.src",
"BaseOS-9.6.0.GA:rsync-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-daemon-0:3.2.5-3.el9.noarch",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-debuginfo-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.aarch64",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.ppc64le",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.s390x",
"BaseOS-9.6.0.GA:rsync-debugsource-0:3.2.5-3.el9.x86_64",
"BaseOS-9.6.0.GA:rsync-rrsync-0:3.2.5-3.el9.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsync: Race Condition in rsync Handling Symbolic Links"
}
]
}
RHSA-2025:8385
Vulnerability from csaf_redhat - Published: 2025-06-02 14:07 - Updated: 2026-05-06 08:40Summary
Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage
Severity
Moderate
Notes
Topic: A Subscription Management tool for finding and reporting Red Hat product usage
Details: Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds, identifies, and reports environment data, or facts, such as the number of physical and virtual systems on a network, their operating systems, and relevant configuration data stored within them. Discovery also identifies and reports more detailed facts for some versions of key Red Hat packages and products that it finds in the network.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Vim, where it is vulnerable to a use-after-free in the ins_compl_get_exp function. This flaw allows a specially crafted file to crash software, use unexpected values, or possibly execute code when opened in Vim.
7.0 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64 | — |
Vendor Fix
fix
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64 | — | ||
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64 | — |
Threats
Impact
Low
A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.
6.5 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.
6.5 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack.
5.3 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition.
5.3 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.
5.6 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64 | — |
Workaround
|
Threats
Impact
Moderate
An incorrect control flow implementation vulnerability was found in Requests. If the first request in a session is made with verify=False, all subsequent requests to the same host will continue to ignore cert verification.
5.6 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64 | — |
Vendor Fix
fix
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64 | — | ||
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64 | — |
Threats
Impact
Moderate
A flaw was found in Git. When cloning, fetching, or pushing from a server, informational or error messages are transported from the remote Git process to the client via a sideband channel. These messages are prefixed with "remote:" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information or to mislead the user into executing untrusted scripts.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in Python. The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accept domain names that included square brackets, which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.
6.8 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in krb5. With incremental propagation enabled, an authenticated attacker can cause kadmind to write beyond the end of the mapped region for the iprop log file. This issue can trigger a process crash and lead to a denial of service.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
6.8 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64 | — |
Workaround
|
Threats
Impact
Moderate
References
79 references
Acknowledgments
Google Project Zero
Jann Horn
Red Hat
Tomas Korbar
Sandipan Roy
libexpat
Sebastian Pipping
Google
Simon Scannell
Pedro Gallegos
Jasiel Spelman
Google
Simon Scannell
Jasiel Spelman
Pedro Gallegos
Bing Shi
Aleksei Gorban "loqpa"
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A Subscription Management tool for finding and reporting Red Hat product usage",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds, identifies, and reports environment data, or facts, such as the number of physical and virtual systems on a network, their operating systems, and relevant configuration data stored within them. Discovery also identifies and reports more detailed facts for some versions of key Red Hat packages and products that it finds in the network.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:8385",
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2023-4752",
"url": "https://access.redhat.com/security/cve/CVE-2023-4752"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-12087",
"url": "https://access.redhat.com/security/cve/CVE-2024-12087"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-12088",
"url": "https://access.redhat.com/security/cve/CVE-2024-12088"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-12133",
"url": "https://access.redhat.com/security/cve/CVE-2024-12133"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-12243",
"url": "https://access.redhat.com/security/cve/CVE-2024-12243"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-12747",
"url": "https://access.redhat.com/security/cve/CVE-2024-12747"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-35195",
"url": "https://access.redhat.com/security/cve/CVE-2024-35195"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-52005",
"url": "https://access.redhat.com/security/cve/CVE-2024-52005"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-8176",
"url": "https://access.redhat.com/security/cve/CVE-2024-8176"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-0938",
"url": "https://access.redhat.com/security/cve/CVE-2025-0938"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-24528",
"url": "https://access.redhat.com/security/cve/CVE-2025-24528"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-26465",
"url": "https://access.redhat.com/security/cve/CVE-2025-26465"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/subscription_central/1-latest/#Discovery",
"url": "https://docs.redhat.com/en/documentation/subscription_central/1-latest/#Discovery"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8385.json"
}
],
"title": "Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage",
"tracking": {
"current_release_date": "2026-05-06T08:40:09+00:00",
"generator": {
"date": "2026-05-06T08:40:09+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.9"
}
},
"id": "RHSA-2025:8385",
"initial_release_date": "2025-06-02T14:07:46+00:00",
"revision_history": [
{
"date": "2025-06-02T14:07:46+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-06-02T14:07:55+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-06T08:40:09+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Discovery 1.14",
"product": {
"name": "Red Hat Discovery 1.14",
"product_id": "Red Hat Discovery 1.14",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:discovery:1.14::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Discovery"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"product": {
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"product_id": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-server-rhel9@sha256%3Af33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63?arch=amd64\u0026repository_url=registry.redhat.io/discovery\u0026tag=1.14.3-1748529279"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"product": {
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"product_id": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-ui-rhel9@sha256%3A492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644?arch=amd64\u0026repository_url=registry.redhat.io/discovery\u0026tag=1.14.2-1748467619"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"product": {
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"product_id": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-server-rhel9@sha256%3Aad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c?arch=arm64\u0026repository_url=registry.redhat.io/discovery\u0026tag=1.14.3-1748529279"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64",
"product": {
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64",
"product_id": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-ui-rhel9@sha256%3Ac960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e?arch=arm64\u0026repository_url=registry.redhat.io/discovery\u0026tag=1.14.2-1748467619"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64 as a component of Red Hat Discovery 1.14",
"product_id": "Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64"
},
"product_reference": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"relates_to_product_reference": "Red Hat Discovery 1.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64 as a component of Red Hat Discovery 1.14",
"product_id": "Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
},
"product_reference": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"relates_to_product_reference": "Red Hat Discovery 1.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64 as a component of Red Hat Discovery 1.14",
"product_id": "Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64"
},
"product_reference": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"relates_to_product_reference": "Red Hat Discovery 1.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64 as a component of Red Hat Discovery 1.14",
"product_id": "Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
},
"product_reference": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64",
"relates_to_product_reference": "Red Hat Discovery 1.14"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-4752",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2023-09-04T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2237311"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vim, where it is vulnerable to a use-after-free in the ins_compl_get_exp function. This flaw allows a specially crafted file to crash software, use unexpected values, or possibly execute code when opened in Vim.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: use-after-free in function ins_compl_get_exp in vim/vim",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security has rated this issue as having a Low security impact, because the \"victim\" has to run an untrusted file IN SCRIPT MODE. Someone who is running untrusted files in script mode is equivalent to someone just taking a random python script and running it.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"known_not_affected": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-4752"
},
{
"category": "external",
"summary": "RHBZ#2237311",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2237311"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-4752",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4752"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-4752",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4752"
},
{
"category": "external",
"summary": "https://huntr.dev/bounties/85f62dd7-ed84-4fa2-b265-8a369a318757",
"url": "https://huntr.dev/bounties/85f62dd7-ed84-4fa2-b265-8a369a318757"
}
],
"release_date": "2023-09-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-02T14:07:46+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "vim: use-after-free in function ins_compl_get_exp in vim/vim"
},
{
"acknowledgments": [
{
"names": [
"Jann Horn"
],
"organization": "Google Project Zero"
},
{
"names": [
"Tomas Korbar",
"Sandipan Roy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
},
{
"names": [
"Sebastian Pipping"
],
"organization": "libexpat"
}
],
"cve": "CVE-2024-8176",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"discovery_date": "2024-06-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2310137"
}
],
"notes": [
{
"category": "description",
"text": "A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "All supported Red Hat offerings are built with the compilation flag (-fstack-clash-protection) which reduces the impact to Moderate. This build configuration blocks the possibility of an attacker gaining arbitrary code execution even if a stack-clash vulnerability, like this one, could be exploited.\n\nThis vulnerability is rated Moderate because Red Hat builds use the `-fstack-clash-protection` compiler flag, which mitigates the risk of arbitrary code execution from stack overflows. While the flaw allows a crash via uncontrolled recursion in XML parsing, the hardened stack layout prevents reliable memory corruption, limiting the impact to a Denial of Service (DoS) scenario.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-8176"
},
{
"category": "external",
"summary": "RHBZ#2310137",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310137"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-8176",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8176"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-8176",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8176"
},
{
"category": "external",
"summary": "https://github.com/libexpat/libexpat/issues/893",
"url": "https://github.com/libexpat/libexpat/issues/893"
},
{
"category": "external",
"summary": "https://github.com/libexpat/libexpat/pull/973",
"url": "https://github.com/libexpat/libexpat/pull/973"
}
],
"release_date": "2025-03-13T13:51:54.957000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-02T14:07:46+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat"
},
{
"acknowledgments": [
{
"names": [
"Simon Scannell",
"Pedro Gallegos",
"Jasiel Spelman"
],
"organization": "Google"
}
],
"cve": "CVE-2024-12087",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2024-12-05T21:23:24.139000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2330672"
}
],
"notes": [
{
"category": "description",
"text": "A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client\u0027s intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: Path traversal vulnerability in rsync",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw to have moderate severity as it depends on specific configurations for the attack to succeed, symbolic link syncing must be enabled (explicitly by providing the `--links` option or implicitly such as with `--archive`) and the client must connect to a malicious or compromised server.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"known_not_affected": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-12087"
},
{
"category": "external",
"summary": "RHBZ#2330672",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330672"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-12087",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12087"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12087",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12087"
},
{
"category": "external",
"summary": "https://kb.cert.org/vuls/id/952657",
"url": "https://kb.cert.org/vuls/id/952657"
}
],
"release_date": "2025-01-14T15:06:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-02T14:07:46+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsync: Path traversal vulnerability in rsync"
},
{
"acknowledgments": [
{
"names": [
"Simon Scannell",
"Jasiel Spelman",
"Pedro Gallegos"
],
"organization": "Google"
}
],
"cve": "CVE-2024-12088",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2024-12-05T21:55:22.700000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2330676"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: --safe-links option bypass leads to path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The vulnerability requires user interaction to be triggered, as the rsync client must first establish a connection/have access to the malicious rsync server (at least anonymous read-access).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"known_not_affected": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-12088"
},
{
"category": "external",
"summary": "RHBZ#2330676",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330676"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-12088",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12088"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12088",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12088"
},
{
"category": "external",
"summary": "https://kb.cert.org/vuls/id/952657",
"url": "https://kb.cert.org/vuls/id/952657"
}
],
"release_date": "2025-01-14T15:06:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-02T14:07:46+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsync: --safe-links option bypass leads to path traversal"
},
{
"acknowledgments": [
{
"names": [
"Bing Shi"
]
}
],
"cve": "CVE-2024-12133",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"discovery_date": "2025-02-10T08:14:05.460000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2344611"
}
],
"notes": [
{
"category": "description",
"text": "A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libtasn1: Inefficient DER Decoding in libtasn1 Leading to Potential Remote DoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-12133"
},
{
"category": "external",
"summary": "RHBZ#2344611",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344611"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-12133",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12133"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12133",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12133"
},
{
"category": "external",
"summary": "https://gitlab.com/gnutls/libtasn1/-/blob/master/doc/security/CVE-2024-12133.md",
"url": "https://gitlab.com/gnutls/libtasn1/-/blob/master/doc/security/CVE-2024-12133.md"
},
{
"category": "external",
"summary": "https://gitlab.com/gnutls/libtasn1/-/issues/52",
"url": "https://gitlab.com/gnutls/libtasn1/-/issues/52"
}
],
"release_date": "2025-02-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-02T14:07:46+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libtasn1: Inefficient DER Decoding in libtasn1 Leading to Potential Remote DoS"
},
{
"acknowledgments": [
{
"names": [
"Bing Shi"
]
}
],
"cve": "CVE-2024-12243",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"discovery_date": "2025-02-10T08:33:56.422000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2344615"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: GnuTLS Impacted by Inefficient DER Decoding in libtasn1 Leading to Remote DoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-12243"
},
{
"category": "external",
"summary": "RHBZ#2344615",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344615"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-12243",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12243"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12243",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12243"
},
{
"category": "external",
"summary": "https://gitlab.com/gnutls/gnutls/-/issues/1553",
"url": "https://gitlab.com/gnutls/gnutls/-/issues/1553"
},
{
"category": "external",
"summary": "https://gitlab.com/gnutls/libtasn1/-/issues/52",
"url": "https://gitlab.com/gnutls/libtasn1/-/issues/52"
}
],
"release_date": "2025-02-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-02T14:07:46+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gnutls: GnuTLS Impacted by Inefficient DER Decoding in libtasn1 Leading to Remote DoS"
},
{
"acknowledgments": [
{
"names": [
"Aleksei Gorban \"loqpa\""
]
}
],
"cve": "CVE-2024-12747",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"discovery_date": "2024-12-18T07:12:52.493000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2332968"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. This vulnerability arises from a race condition during rsync\u0027s handling of symbolic links. Rsync\u0027s default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: Race Condition in rsync Handling Symbolic Links",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"known_not_affected": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-12747"
},
{
"category": "external",
"summary": "RHBZ#2332968",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2332968"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-12747",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12747"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12747",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12747"
},
{
"category": "external",
"summary": "https://kb.cert.org/vuls/id/952657",
"url": "https://kb.cert.org/vuls/id/952657"
}
],
"release_date": "2025-01-14T15:06:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-02T14:07:46+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsync: Race Condition in rsync Handling Symbolic Links"
},
{
"cve": "CVE-2024-35195",
"cwe": {
"id": "CWE-670",
"name": "Always-Incorrect Control Flow Implementation"
},
"discovery_date": "2024-05-21T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2282114"
}
],
"notes": [
{
"category": "description",
"text": "An incorrect control flow implementation vulnerability was found in Requests. If the first request in a session is made with verify=False, all subsequent requests to the same host will continue to ignore cert verification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "requests: subsequent requests to the same host ignore cert verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"known_not_affected": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-35195"
},
{
"category": "external",
"summary": "RHBZ#2282114",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2282114"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-35195",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35195"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-35195",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35195"
},
{
"category": "external",
"summary": "https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56",
"url": "https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56"
}
],
"release_date": "2024-05-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-02T14:07:46+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "requests: subsequent requests to the same host ignore cert verification"
},
{
"cve": "CVE-2024-52005",
"cwe": {
"id": "CWE-838",
"name": "Inappropriate Encoding for Output Context"
},
"discovery_date": "2025-01-15T18:01:05.807300+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2338289"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Git. When cloning, fetching, or pushing from a server, informational or error messages are transported from the remote Git process to the client via a sideband channel. These messages are prefixed with \"remote:\" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information or to mislead the user into executing untrusted scripts.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "git: The sideband payload is passed unfiltered to the terminal in git",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is classified as moderate rather than important because it primarily affects informational messages rather than directly compromising repository integrity or executing arbitrary code. The issue arises from Git\u0027s failure to sanitize ANSI escape sequences in messages received over the sideband channel, which could allow a malicious remote repository to manipulate terminal output. However, exploitation requires user interaction, such as manually copying and executing misleading commands. Unlike higher-severity vulnerabilities, this does not provide direct unauthorized access, remote code execution, or privilege escalation, limiting its overall impact. The risk is further mitigated by best practices, such as avoiding recursive clones from untrusted sources.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
],
"known_not_affected": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-52005"
},
{
"category": "external",
"summary": "RHBZ#2338289",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2338289"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-52005",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-52005"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-52005",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52005"
},
{
"category": "external",
"summary": "https://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329",
"url": "https://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329"
},
{
"category": "external",
"summary": "https://lore.kernel.org/git/1M9FnZ-1taoNo1wwh-00ESSd@mail.gmx.net",
"url": "https://lore.kernel.org/git/1M9FnZ-1taoNo1wwh-00ESSd@mail.gmx.net"
}
],
"release_date": "2025-01-15T17:35:02.379000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-02T14:07:46+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "git: The sideband payload is passed unfiltered to the terminal in git"
},
{
"cve": "CVE-2025-0938",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-01-31T18:00:46.128427+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2343237"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Python. The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accept domain names that included square brackets, which isn\u0027t valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: cpython: URL parser allowed square brackets in domain names",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-0938"
},
{
"category": "external",
"summary": "RHBZ#2343237",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2343237"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-0938",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0938"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-0938",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0938"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/105704",
"url": "https://github.com/python/cpython/issues/105704"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/129418",
"url": "https://github.com/python/cpython/pull/129418"
}
],
"release_date": "2025-01-31T17:51:35.898000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-02T14:07:46+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python: cpython: URL parser allowed square brackets in domain names"
},
{
"cve": "CVE-2025-24528",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2025-01-29T13:47:59.362000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2342796"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in krb5. With incremental propagation enabled, an authenticated attacker can cause kadmind to write beyond the end of the mapped region for the iprop log file. This issue can trigger a process crash and lead to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "krb5: overflow when calculating ulog block size",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-24528"
},
{
"category": "external",
"summary": "RHBZ#2342796",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2342796"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-24528",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24528"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-24528",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24528"
},
{
"category": "external",
"summary": "https://github.com/krb5/krb5/commit/78ceba024b64d49612375be4a12d1c066b0bfbd0",
"url": "https://github.com/krb5/krb5/commit/78ceba024b64d49612375be4a12d1c066b0bfbd0"
}
],
"release_date": "2024-01-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-02T14:07:46+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "krb5: overflow when calculating ulog block size"
},
{
"cve": "CVE-2025-26465",
"cwe": {
"id": "CWE-390",
"name": "Detection of Error Condition Without Action"
},
"discovery_date": "2025-02-10T21:56:03.853000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2344780"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client\u0027s memory resource first, turning the attack complexity high.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssh: Machine-in-the-middle attack if VerifyHostKeyDNS is enabled",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is rated as a moderate severity vulnerability instead of important because it requires specific conditions to be exploitable. First, the OpenSSH client must have the VerifyHostKeyDNS option enabled, which is disabled by default in Red Hat Enterprise Linux (RHEL). \n\nAdditionally, while the attack allows a machine-in-the-middle (MITM) adversary to trick the client into accepting an incorrect host key, it does not directly lead to code execution or immediate system compromise. Instead, the attack requires additional steps, such as credential interception or session hijacking to fully exploit the breach.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
],
"known_not_affected": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-26465"
},
{
"category": "external",
"summary": "RHBZ#2344780",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344780"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-26465",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26465"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-26465",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26465"
},
{
"category": "external",
"summary": "https://access.redhat.com/solutions/7109879",
"url": "https://access.redhat.com/solutions/7109879"
},
{
"category": "external",
"summary": "https://seclists.org/oss-sec/2025/q1/144",
"url": "https://seclists.org/oss-sec/2025/q1/144"
}
],
"release_date": "2025-02-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-02T14:07:46+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssh: Machine-in-the-middle attack if VerifyHostKeyDNS is enabled"
}
]
}
SUSE-SU-2025:0156-1
Vulnerability from csaf_suse - Published: 2025-01-17 11:59 - Updated: 2025-01-17 11:59Summary
Security update for rsync
Severity
Important
Notes
Title of the patch: Security update for rsync
Description of the patch: This update for rsync fixes the following issues:
- CVE-2024-12084: heap buffer overflow in checksum parsing. (bsc#1234100)
- CVE-2024-12085: leak of uninitialized stack data on the server leading to possible ASLR bypass. (bsc#1234101)
- CVE-2024-12086: leak of a client machine's file contents through the processing of checksum data. (bsc#1234102)
- CVE-2024-12087: arbitrary file overwrite possible on clients when symlink syncing is enabled. (bsc#1234103)
- CVE-2024-12088: bypass of the --safe-links flag may allow the placement of unsafe symlinks in a client. (bsc#1234104)
- CVE-2024-12747: race condition in rsync handling symbolic links (bsc#1235475)
Patchnames: SUSE-2025-156,SUSE-SLE-Module-Basesystem-15-SP6-2025-156,openSUSE-SLE-15.6-2025-156
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
9.8 (Critical)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
critical
5.3 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
8.8 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.3 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
References
35 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for rsync",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for rsync fixes the following issues:\n\n- CVE-2024-12084: heap buffer overflow in checksum parsing. (bsc#1234100)\n- CVE-2024-12085: leak of uninitialized stack data on the server leading to possible ASLR bypass. (bsc#1234101)\n- CVE-2024-12086: leak of a client machine\u0027s file contents through the processing of checksum data. (bsc#1234102)\n- CVE-2024-12087: arbitrary file overwrite possible on clients when symlink syncing is enabled. (bsc#1234103)\n- CVE-2024-12088: bypass of the --safe-links flag may allow the placement of unsafe symlinks in a client. (bsc#1234104)\n- CVE-2024-12747: race condition in rsync handling symbolic links (bsc#1235475)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2025-156,SUSE-SLE-Module-Basesystem-15-SP6-2025-156,openSUSE-SLE-15.6-2025-156",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_0156-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:0156-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-20250156-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:0156-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-January/020160.html"
},
{
"category": "self",
"summary": "SUSE Bug 1234100",
"url": "https://bugzilla.suse.com/1234100"
},
{
"category": "self",
"summary": "SUSE Bug 1234101",
"url": "https://bugzilla.suse.com/1234101"
},
{
"category": "self",
"summary": "SUSE Bug 1234102",
"url": "https://bugzilla.suse.com/1234102"
},
{
"category": "self",
"summary": "SUSE Bug 1234103",
"url": "https://bugzilla.suse.com/1234103"
},
{
"category": "self",
"summary": "SUSE Bug 1234104",
"url": "https://bugzilla.suse.com/1234104"
},
{
"category": "self",
"summary": "SUSE Bug 1235475",
"url": "https://bugzilla.suse.com/1235475"
},
{
"category": "self",
"summary": "SUSE Bug 1235895",
"url": "https://bugzilla.suse.com/1235895"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-12084 page",
"url": "https://www.suse.com/security/cve/CVE-2024-12084/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-12085 page",
"url": "https://www.suse.com/security/cve/CVE-2024-12085/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-12086 page",
"url": "https://www.suse.com/security/cve/CVE-2024-12086/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-12087 page",
"url": "https://www.suse.com/security/cve/CVE-2024-12087/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-12088 page",
"url": "https://www.suse.com/security/cve/CVE-2024-12088/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-12747 page",
"url": "https://www.suse.com/security/cve/CVE-2024-12747/"
}
],
"title": "Security update for rsync",
"tracking": {
"current_release_date": "2025-01-17T11:59:08Z",
"generator": {
"date": "2025-01-17T11:59:08Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:0156-1",
"initial_release_date": "2025-01-17T11:59:08Z",
"revision_history": [
{
"date": "2025-01-17T11:59:08Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "rsync-3.2.7-150600.3.8.1.aarch64",
"product": {
"name": "rsync-3.2.7-150600.3.8.1.aarch64",
"product_id": "rsync-3.2.7-150600.3.8.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-3.2.7-150600.3.8.1.i586",
"product": {
"name": "rsync-3.2.7-150600.3.8.1.i586",
"product_id": "rsync-3.2.7-150600.3.8.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-3.2.7-150600.3.8.1.ppc64le",
"product": {
"name": "rsync-3.2.7-150600.3.8.1.ppc64le",
"product_id": "rsync-3.2.7-150600.3.8.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-3.2.7-150600.3.8.1.s390x",
"product": {
"name": "rsync-3.2.7-150600.3.8.1.s390x",
"product_id": "rsync-3.2.7-150600.3.8.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-3.2.7-150600.3.8.1.x86_64",
"product": {
"name": "rsync-3.2.7-150600.3.8.1.x86_64",
"product_id": "rsync-3.2.7-150600.3.8.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Basesystem 15 SP6",
"product": {
"name": "SUSE Linux Enterprise Module for Basesystem 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP6",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-basesystem:15:sp6"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.6",
"product": {
"name": "openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.6"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.7-150600.3.8.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64"
},
"product_reference": "rsync-3.2.7-150600.3.8.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.7-150600.3.8.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le"
},
"product_reference": "rsync-3.2.7-150600.3.8.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.7-150600.3.8.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x"
},
"product_reference": "rsync-3.2.7-150600.3.8.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.7-150600.3.8.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64"
},
"product_reference": "rsync-3.2.7-150600.3.8.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.7-150600.3.8.1.aarch64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64"
},
"product_reference": "rsync-3.2.7-150600.3.8.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.7-150600.3.8.1.ppc64le as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le"
},
"product_reference": "rsync-3.2.7-150600.3.8.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.7-150600.3.8.1.s390x as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x"
},
"product_reference": "rsync-3.2.7-150600.3.8.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.7-150600.3.8.1.x86_64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64"
},
"product_reference": "rsync-3.2.7-150600.3.8.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-12084",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-12084"
}
],
"notes": [
{
"category": "general",
"text": "A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-12084",
"url": "https://www.suse.com/security/cve/CVE-2024-12084"
},
{
"category": "external",
"summary": "SUSE Bug 1233760 for CVE-2024-12084",
"url": "https://bugzilla.suse.com/1233760"
},
{
"category": "external",
"summary": "SUSE Bug 1234100 for CVE-2024-12084",
"url": "https://bugzilla.suse.com/1234100"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-17T11:59:08Z",
"details": "critical"
}
],
"title": "CVE-2024-12084"
},
{
"cve": "CVE-2024-12085",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-12085"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-12085",
"url": "https://www.suse.com/security/cve/CVE-2024-12085"
},
{
"category": "external",
"summary": "SUSE Bug 1233760 for CVE-2024-12085",
"url": "https://bugzilla.suse.com/1233760"
},
{
"category": "external",
"summary": "SUSE Bug 1234101 for CVE-2024-12085",
"url": "https://bugzilla.suse.com/1234101"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-17T11:59:08Z",
"details": "moderate"
}
],
"title": "CVE-2024-12085"
},
{
"cve": "CVE-2024-12086",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-12086"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client\u0027s machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-12086",
"url": "https://www.suse.com/security/cve/CVE-2024-12086"
},
{
"category": "external",
"summary": "SUSE Bug 1233760 for CVE-2024-12086",
"url": "https://bugzilla.suse.com/1233760"
},
{
"category": "external",
"summary": "SUSE Bug 1234102 for CVE-2024-12086",
"url": "https://bugzilla.suse.com/1234102"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-17T11:59:08Z",
"details": "moderate"
}
],
"title": "CVE-2024-12086"
},
{
"cve": "CVE-2024-12087",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-12087"
}
],
"notes": [
{
"category": "general",
"text": "A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client\u0027s intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-12087",
"url": "https://www.suse.com/security/cve/CVE-2024-12087"
},
{
"category": "external",
"summary": "SUSE Bug 1233760 for CVE-2024-12087",
"url": "https://bugzilla.suse.com/1233760"
},
{
"category": "external",
"summary": "SUSE Bug 1234103 for CVE-2024-12087",
"url": "https://bugzilla.suse.com/1234103"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-17T11:59:08Z",
"details": "important"
}
],
"title": "CVE-2024-12087"
},
{
"cve": "CVE-2024-12088",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-12088"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-12088",
"url": "https://www.suse.com/security/cve/CVE-2024-12088"
},
{
"category": "external",
"summary": "SUSE Bug 1233760 for CVE-2024-12088",
"url": "https://bugzilla.suse.com/1233760"
},
{
"category": "external",
"summary": "SUSE Bug 1234104 for CVE-2024-12088",
"url": "https://bugzilla.suse.com/1234104"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-17T11:59:08Z",
"details": "moderate"
}
],
"title": "CVE-2024-12088"
},
{
"cve": "CVE-2024-12747",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-12747"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in rsync. This vulnerability arises from a race condition during rsync\u0027s handling of symbolic links. Rsync\u0027s default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-12747",
"url": "https://www.suse.com/security/cve/CVE-2024-12747"
},
{
"category": "external",
"summary": "SUSE Bug 1233760 for CVE-2024-12747",
"url": "https://bugzilla.suse.com/1233760"
},
{
"category": "external",
"summary": "SUSE Bug 1235475 for CVE-2024-12747",
"url": "https://bugzilla.suse.com/1235475"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:rsync-3.2.7-150600.3.8.1.x86_64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.aarch64",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.ppc64le",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.s390x",
"openSUSE Leap 15.6:rsync-3.2.7-150600.3.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-17T11:59:08Z",
"details": "moderate"
}
],
"title": "CVE-2024-12747"
}
]
}
SUSE-SU-2025:0157-1
Vulnerability from csaf_suse - Published: 2025-01-17 11:59 - Updated: 2025-01-17 11:59Summary
Security update for rsync
Severity
Important
Notes
Title of the patch: Security update for rsync
Description of the patch: This update for rsync fixes the following issues:
- CVE-2024-12085: leak of uninitialized stack data on the server leading to possible ASLR bypass. (bsc#1234101)
- CVE-2024-12086: leak of a client machine's file contents through the processing of checksum data. (bsc#1234102)
- CVE-2024-12087: arbitrary file overwrite possible on clients when symlink syncing is enabled. (bsc#1234103)
- CVE-2024-12088: bypass of the --safe-links flag may allow the placement of unsafe symlinks in a client. (bsc#1234104)
- CVE-2024-12747: Fixed a race condition in rsync handling symbolic links. (bsc#1235475)
Patchnames: SUSE-2025-157,SUSE-SLE-Product-HPC-15-SP3-LTSS-2025-157,SUSE-SLE-Product-SLES-15-SP3-LTSS-2025-157,SUSE-SLE-Product-SLES_SAP-15-SP3-2025-157,SUSE-SUSE-MicroOS-5.1-2025-157,SUSE-SUSE-MicroOS-5.2-2025-157,SUSE-Storage-7.1-2025-157
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.3 (Medium)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
8.8 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.3 (Medium)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
References
30 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for rsync",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for rsync fixes the following issues:\n\n- CVE-2024-12085: leak of uninitialized stack data on the server leading to possible ASLR bypass. (bsc#1234101)\n- CVE-2024-12086: leak of a client machine\u0027s file contents through the processing of checksum data. (bsc#1234102)\n- CVE-2024-12087: arbitrary file overwrite possible on clients when symlink syncing is enabled. (bsc#1234103)\n- CVE-2024-12088: bypass of the --safe-links flag may allow the placement of unsafe symlinks in a client. (bsc#1234104)\n- CVE-2024-12747: Fixed a race condition in rsync handling symbolic links. (bsc#1235475)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2025-157,SUSE-SLE-Product-HPC-15-SP3-LTSS-2025-157,SUSE-SLE-Product-SLES-15-SP3-LTSS-2025-157,SUSE-SLE-Product-SLES_SAP-15-SP3-2025-157,SUSE-SUSE-MicroOS-5.1-2025-157,SUSE-SUSE-MicroOS-5.2-2025-157,SUSE-Storage-7.1-2025-157",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_0157-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:0157-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-20250157-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:0157-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-January/020159.html"
},
{
"category": "self",
"summary": "SUSE Bug 1234101",
"url": "https://bugzilla.suse.com/1234101"
},
{
"category": "self",
"summary": "SUSE Bug 1234102",
"url": "https://bugzilla.suse.com/1234102"
},
{
"category": "self",
"summary": "SUSE Bug 1234103",
"url": "https://bugzilla.suse.com/1234103"
},
{
"category": "self",
"summary": "SUSE Bug 1234104",
"url": "https://bugzilla.suse.com/1234104"
},
{
"category": "self",
"summary": "SUSE Bug 1235475",
"url": "https://bugzilla.suse.com/1235475"
},
{
"category": "self",
"summary": "SUSE Bug 1235895",
"url": "https://bugzilla.suse.com/1235895"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-12085 page",
"url": "https://www.suse.com/security/cve/CVE-2024-12085/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-12086 page",
"url": "https://www.suse.com/security/cve/CVE-2024-12086/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-12087 page",
"url": "https://www.suse.com/security/cve/CVE-2024-12087/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-12088 page",
"url": "https://www.suse.com/security/cve/CVE-2024-12088/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-12747 page",
"url": "https://www.suse.com/security/cve/CVE-2024-12747/"
}
],
"title": "Security update for rsync",
"tracking": {
"current_release_date": "2025-01-17T11:59:43Z",
"generator": {
"date": "2025-01-17T11:59:43Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:0157-1",
"initial_release_date": "2025-01-17T11:59:43Z",
"revision_history": [
{
"date": "2025-01-17T11:59:43Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "rsync-3.2.3-150000.4.33.1.aarch64",
"product": {
"name": "rsync-3.2.3-150000.4.33.1.aarch64",
"product_id": "rsync-3.2.3-150000.4.33.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-3.2.3-150000.4.33.1.i586",
"product": {
"name": "rsync-3.2.3-150000.4.33.1.i586",
"product_id": "rsync-3.2.3-150000.4.33.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-3.2.3-150000.4.33.1.ppc64le",
"product": {
"name": "rsync-3.2.3-150000.4.33.1.ppc64le",
"product_id": "rsync-3.2.3-150000.4.33.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-3.2.3-150000.4.33.1.s390x",
"product": {
"name": "rsync-3.2.3-150000.4.33.1.s390x",
"product_id": "rsync-3.2.3-150000.4.33.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-3.2.3-150000.4.33.1.x86_64",
"product": {
"name": "rsync-3.2.3-150000.4.33.1.x86_64",
"product_id": "rsync-3.2.3-150000.4.33.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP3-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP3",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.1",
"product": {
"name": "SUSE Linux Enterprise Micro 5.1",
"product_id": "SUSE Linux Enterprise Micro 5.1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-microos:5.1"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.2",
"product": {
"name": "SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-microos:5.2"
}
}
},
{
"category": "product_name",
"name": "SUSE Enterprise Storage 7.1",
"product": {
"name": "SUSE Enterprise Storage 7.1",
"product_id": "SUSE Enterprise Storage 7.1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:ses:7.1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150000.4.33.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64"
},
"product_reference": "rsync-3.2.3-150000.4.33.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150000.4.33.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64"
},
"product_reference": "rsync-3.2.3-150000.4.33.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150000.4.33.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64"
},
"product_reference": "rsync-3.2.3-150000.4.33.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150000.4.33.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.ppc64le"
},
"product_reference": "rsync-3.2.3-150000.4.33.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150000.4.33.1.s390x as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.s390x"
},
"product_reference": "rsync-3.2.3-150000.4.33.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150000.4.33.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64"
},
"product_reference": "rsync-3.2.3-150000.4.33.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150000.4.33.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.ppc64le"
},
"product_reference": "rsync-3.2.3-150000.4.33.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150000.4.33.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.x86_64"
},
"product_reference": "rsync-3.2.3-150000.4.33.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150000.4.33.1.aarch64 as component of SUSE Linux Enterprise Micro 5.1",
"product_id": "SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.aarch64"
},
"product_reference": "rsync-3.2.3-150000.4.33.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150000.4.33.1.s390x as component of SUSE Linux Enterprise Micro 5.1",
"product_id": "SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.s390x"
},
"product_reference": "rsync-3.2.3-150000.4.33.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150000.4.33.1.x86_64 as component of SUSE Linux Enterprise Micro 5.1",
"product_id": "SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.x86_64"
},
"product_reference": "rsync-3.2.3-150000.4.33.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150000.4.33.1.aarch64 as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.aarch64"
},
"product_reference": "rsync-3.2.3-150000.4.33.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150000.4.33.1.s390x as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.s390x"
},
"product_reference": "rsync-3.2.3-150000.4.33.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150000.4.33.1.x86_64 as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.x86_64"
},
"product_reference": "rsync-3.2.3-150000.4.33.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150000.4.33.1.aarch64 as component of SUSE Enterprise Storage 7.1",
"product_id": "SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.aarch64"
},
"product_reference": "rsync-3.2.3-150000.4.33.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 7.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150000.4.33.1.x86_64 as component of SUSE Enterprise Storage 7.1",
"product_id": "SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.x86_64"
},
"product_reference": "rsync-3.2.3-150000.4.33.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 7.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-12085",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-12085"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-12085",
"url": "https://www.suse.com/security/cve/CVE-2024-12085"
},
{
"category": "external",
"summary": "SUSE Bug 1233760 for CVE-2024-12085",
"url": "https://bugzilla.suse.com/1233760"
},
{
"category": "external",
"summary": "SUSE Bug 1234101 for CVE-2024-12085",
"url": "https://bugzilla.suse.com/1234101"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-17T11:59:43Z",
"details": "moderate"
}
],
"title": "CVE-2024-12085"
},
{
"cve": "CVE-2024-12086",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-12086"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client\u0027s machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-12086",
"url": "https://www.suse.com/security/cve/CVE-2024-12086"
},
{
"category": "external",
"summary": "SUSE Bug 1233760 for CVE-2024-12086",
"url": "https://bugzilla.suse.com/1233760"
},
{
"category": "external",
"summary": "SUSE Bug 1234102 for CVE-2024-12086",
"url": "https://bugzilla.suse.com/1234102"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-17T11:59:43Z",
"details": "moderate"
}
],
"title": "CVE-2024-12086"
},
{
"cve": "CVE-2024-12087",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-12087"
}
],
"notes": [
{
"category": "general",
"text": "A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client\u0027s intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-12087",
"url": "https://www.suse.com/security/cve/CVE-2024-12087"
},
{
"category": "external",
"summary": "SUSE Bug 1233760 for CVE-2024-12087",
"url": "https://bugzilla.suse.com/1233760"
},
{
"category": "external",
"summary": "SUSE Bug 1234103 for CVE-2024-12087",
"url": "https://bugzilla.suse.com/1234103"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-17T11:59:43Z",
"details": "important"
}
],
"title": "CVE-2024-12087"
},
{
"cve": "CVE-2024-12088",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-12088"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-12088",
"url": "https://www.suse.com/security/cve/CVE-2024-12088"
},
{
"category": "external",
"summary": "SUSE Bug 1233760 for CVE-2024-12088",
"url": "https://bugzilla.suse.com/1233760"
},
{
"category": "external",
"summary": "SUSE Bug 1234104 for CVE-2024-12088",
"url": "https://bugzilla.suse.com/1234104"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-17T11:59:43Z",
"details": "moderate"
}
],
"title": "CVE-2024-12088"
},
{
"cve": "CVE-2024-12747",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-12747"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in rsync. This vulnerability arises from a race condition during rsync\u0027s handling of symbolic links. Rsync\u0027s default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-12747",
"url": "https://www.suse.com/security/cve/CVE-2024-12747"
},
{
"category": "external",
"summary": "SUSE Bug 1233760 for CVE-2024-12747",
"url": "https://bugzilla.suse.com/1233760"
},
{
"category": "external",
"summary": "SUSE Bug 1235475 for CVE-2024-12747",
"url": "https://bugzilla.suse.com/1235475"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Micro 5.2:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:rsync-3.2.3-150000.4.33.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:rsync-3.2.3-150000.4.33.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-17T11:59:43Z",
"details": "moderate"
}
],
"title": "CVE-2024-12747"
}
]
}
SUSE-SU-2025:0165-1
Vulnerability from csaf_suse - Published: 2025-01-17 16:09 - Updated: 2025-01-17 16:09Summary
Security update for rsync
Severity
Important
Notes
Title of the patch: Security update for rsync
Description of the patch: This update for rsync fixes the following issues:
- CVE-2024-12085: leak of uninitialized stack data on the server leading to possible ASLR bypass. (bsc#1234101)
- CVE-2024-12086: leak of a client machine's file contents through the processing of checksum data. (bsc#1234102)
- CVE-2024-12087: arbitrary file overwrite possible on clients when symlink syncing is enabled. (bsc#1234103)
- CVE-2024-12088: bypass of the --safe-links flag may allow the placement of unsafe symlinks in a client. (bsc#1234104)
- CVE-2024-12747: Fixed a race condition in rsync handling symbolic links. (bsc#1235475)
Patchnames: SUSE-2025-165,SUSE-SLE-Micro-5.3-2025-165,SUSE-SLE-Micro-5.4-2025-165,SUSE-SLE-Micro-5.5-2025-165,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2025-165,SUSE-SLE-Product-HPC-15-SP4-LTSS-2025-165,SUSE-SLE-Product-HPC-15-SP5-ESPOS-2025-165,SUSE-SLE-Product-HPC-15-SP5-LTSS-2025-165,SUSE-SLE-Product-SLES-15-SP4-LTSS-2025-165,SUSE-SLE-Product-SLES-15-SP5-LTSS-2025-165,SUSE-SLE-Product-SLES_SAP-15-SP4-2025-165,SUSE-SLE-Product-SLES_SAP-15-SP5-2025-165,SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2025-165,SUSE-SLE-Product-SUSE-Manager-Server-4.3-2025-165
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.3 (Medium)
Affected products
Recommended
34 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Proxy 4.3:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
34 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Proxy 4.3:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
8.8 (High)
Affected products
Recommended
34 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Proxy 4.3:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
34 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Proxy 4.3:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.3 (Medium)
Affected products
Recommended
34 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Proxy 4.3:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
References
30 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for rsync",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for rsync fixes the following issues:\n\n- CVE-2024-12085: leak of uninitialized stack data on the server leading to possible ASLR bypass. (bsc#1234101)\n- CVE-2024-12086: leak of a client machine\u0027s file contents through the processing of checksum data. (bsc#1234102)\n- CVE-2024-12087: arbitrary file overwrite possible on clients when symlink syncing is enabled. (bsc#1234103)\n- CVE-2024-12088: bypass of the --safe-links flag may allow the placement of unsafe symlinks in a client. (bsc#1234104)\n- CVE-2024-12747: Fixed a race condition in rsync handling symbolic links. (bsc#1235475)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2025-165,SUSE-SLE-Micro-5.3-2025-165,SUSE-SLE-Micro-5.4-2025-165,SUSE-SLE-Micro-5.5-2025-165,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2025-165,SUSE-SLE-Product-HPC-15-SP4-LTSS-2025-165,SUSE-SLE-Product-HPC-15-SP5-ESPOS-2025-165,SUSE-SLE-Product-HPC-15-SP5-LTSS-2025-165,SUSE-SLE-Product-SLES-15-SP4-LTSS-2025-165,SUSE-SLE-Product-SLES-15-SP5-LTSS-2025-165,SUSE-SLE-Product-SLES_SAP-15-SP4-2025-165,SUSE-SLE-Product-SLES_SAP-15-SP5-2025-165,SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2025-165,SUSE-SLE-Product-SUSE-Manager-Server-4.3-2025-165",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_0165-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:0165-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-20250165-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:0165-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-January/020168.html"
},
{
"category": "self",
"summary": "SUSE Bug 1234101",
"url": "https://bugzilla.suse.com/1234101"
},
{
"category": "self",
"summary": "SUSE Bug 1234102",
"url": "https://bugzilla.suse.com/1234102"
},
{
"category": "self",
"summary": "SUSE Bug 1234103",
"url": "https://bugzilla.suse.com/1234103"
},
{
"category": "self",
"summary": "SUSE Bug 1234104",
"url": "https://bugzilla.suse.com/1234104"
},
{
"category": "self",
"summary": "SUSE Bug 1235475",
"url": "https://bugzilla.suse.com/1235475"
},
{
"category": "self",
"summary": "SUSE Bug 1235895",
"url": "https://bugzilla.suse.com/1235895"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-12085 page",
"url": "https://www.suse.com/security/cve/CVE-2024-12085/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-12086 page",
"url": "https://www.suse.com/security/cve/CVE-2024-12086/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-12087 page",
"url": "https://www.suse.com/security/cve/CVE-2024-12087/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-12088 page",
"url": "https://www.suse.com/security/cve/CVE-2024-12088/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-12747 page",
"url": "https://www.suse.com/security/cve/CVE-2024-12747/"
}
],
"title": "Security update for rsync",
"tracking": {
"current_release_date": "2025-01-17T16:09:34Z",
"generator": {
"date": "2025-01-17T16:09:34Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:0165-1",
"initial_release_date": "2025-01-17T16:09:34Z",
"revision_history": [
{
"date": "2025-01-17T16:09:34Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "rsync-3.2.3-150400.3.17.1.aarch64",
"product": {
"name": "rsync-3.2.3-150400.3.17.1.aarch64",
"product_id": "rsync-3.2.3-150400.3.17.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-3.2.3-150400.3.17.1.i586",
"product": {
"name": "rsync-3.2.3-150400.3.17.1.i586",
"product_id": "rsync-3.2.3-150400.3.17.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-3.2.3-150400.3.17.1.ppc64le",
"product": {
"name": "rsync-3.2.3-150400.3.17.1.ppc64le",
"product_id": "rsync-3.2.3-150400.3.17.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-3.2.3-150400.3.17.1.s390x",
"product": {
"name": "rsync-3.2.3-150400.3.17.1.s390x",
"product_id": "rsync-3.2.3-150400.3.17.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-3.2.3-150400.3.17.1.x86_64",
"product": {
"name": "rsync-3.2.3-150400.3.17.1.x86_64",
"product_id": "rsync-3.2.3-150400.3.17.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.3",
"product": {
"name": "SUSE Linux Enterprise Micro 5.3",
"product_id": "SUSE Linux Enterprise Micro 5.3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-micro:5.3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.4",
"product": {
"name": "SUSE Linux Enterprise Micro 5.4",
"product_id": "SUSE Linux Enterprise Micro 5.4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-micro:5.4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.5",
"product": {
"name": "SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-micro:5.5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-espos:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-espos:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Manager Proxy 4.3",
"product": {
"name": "SUSE Manager Proxy 4.3",
"product_id": "SUSE Manager Proxy 4.3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-manager-proxy:4.3"
}
}
},
{
"category": "product_name",
"name": "SUSE Manager Server 4.3",
"product": {
"name": "SUSE Manager Server 4.3",
"product_id": "SUSE Manager Server 4.3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-manager-server:4.3"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.aarch64 as component of SUSE Linux Enterprise Micro 5.3",
"product_id": "SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.aarch64"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.s390x as component of SUSE Linux Enterprise Micro 5.3",
"product_id": "SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.s390x"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.x86_64 as component of SUSE Linux Enterprise Micro 5.3",
"product_id": "SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.x86_64"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.aarch64 as component of SUSE Linux Enterprise Micro 5.4",
"product_id": "SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.aarch64"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.s390x as component of SUSE Linux Enterprise Micro 5.4",
"product_id": "SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.s390x"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.x86_64 as component of SUSE Linux Enterprise Micro 5.4",
"product_id": "SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.x86_64"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.aarch64 as component of SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.aarch64"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.ppc64le as component of SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.ppc64le"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.s390x as component of SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.s390x"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.x86_64 as component of SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.x86_64"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.s390x as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.s390x"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.s390x as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.s390x"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.ppc64le"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.x86_64"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.ppc64le"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.x86_64"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.x86_64 as component of SUSE Manager Proxy 4.3",
"product_id": "SUSE Manager Proxy 4.3:rsync-3.2.3-150400.3.17.1.x86_64"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.x86_64",
"relates_to_product_reference": "SUSE Manager Proxy 4.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.ppc64le as component of SUSE Manager Server 4.3",
"product_id": "SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.ppc64le"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.ppc64le",
"relates_to_product_reference": "SUSE Manager Server 4.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.s390x as component of SUSE Manager Server 4.3",
"product_id": "SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.s390x"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.s390x",
"relates_to_product_reference": "SUSE Manager Server 4.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-3.2.3-150400.3.17.1.x86_64 as component of SUSE Manager Server 4.3",
"product_id": "SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.x86_64"
},
"product_reference": "rsync-3.2.3-150400.3.17.1.x86_64",
"relates_to_product_reference": "SUSE Manager Server 4.3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-12085",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-12085"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Proxy 4.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-12085",
"url": "https://www.suse.com/security/cve/CVE-2024-12085"
},
{
"category": "external",
"summary": "SUSE Bug 1233760 for CVE-2024-12085",
"url": "https://bugzilla.suse.com/1233760"
},
{
"category": "external",
"summary": "SUSE Bug 1234101 for CVE-2024-12085",
"url": "https://bugzilla.suse.com/1234101"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Proxy 4.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Proxy 4.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-17T16:09:34Z",
"details": "moderate"
}
],
"title": "CVE-2024-12085"
},
{
"cve": "CVE-2024-12086",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-12086"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client\u0027s machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Proxy 4.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-12086",
"url": "https://www.suse.com/security/cve/CVE-2024-12086"
},
{
"category": "external",
"summary": "SUSE Bug 1233760 for CVE-2024-12086",
"url": "https://bugzilla.suse.com/1233760"
},
{
"category": "external",
"summary": "SUSE Bug 1234102 for CVE-2024-12086",
"url": "https://bugzilla.suse.com/1234102"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Proxy 4.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Proxy 4.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-17T16:09:34Z",
"details": "moderate"
}
],
"title": "CVE-2024-12086"
},
{
"cve": "CVE-2024-12087",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-12087"
}
],
"notes": [
{
"category": "general",
"text": "A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client\u0027s intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Proxy 4.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-12087",
"url": "https://www.suse.com/security/cve/CVE-2024-12087"
},
{
"category": "external",
"summary": "SUSE Bug 1233760 for CVE-2024-12087",
"url": "https://bugzilla.suse.com/1233760"
},
{
"category": "external",
"summary": "SUSE Bug 1234103 for CVE-2024-12087",
"url": "https://bugzilla.suse.com/1234103"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Proxy 4.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Proxy 4.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-17T16:09:34Z",
"details": "important"
}
],
"title": "CVE-2024-12087"
},
{
"cve": "CVE-2024-12088",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-12088"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Proxy 4.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-12088",
"url": "https://www.suse.com/security/cve/CVE-2024-12088"
},
{
"category": "external",
"summary": "SUSE Bug 1233760 for CVE-2024-12088",
"url": "https://bugzilla.suse.com/1233760"
},
{
"category": "external",
"summary": "SUSE Bug 1234104 for CVE-2024-12088",
"url": "https://bugzilla.suse.com/1234104"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Proxy 4.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Proxy 4.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-17T16:09:34Z",
"details": "moderate"
}
],
"title": "CVE-2024-12088"
},
{
"cve": "CVE-2024-12747",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-12747"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in rsync. This vulnerability arises from a race condition during rsync\u0027s handling of symbolic links. Rsync\u0027s default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Proxy 4.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-12747",
"url": "https://www.suse.com/security/cve/CVE-2024-12747"
},
{
"category": "external",
"summary": "SUSE Bug 1233760 for CVE-2024-12747",
"url": "https://bugzilla.suse.com/1233760"
},
{
"category": "external",
"summary": "SUSE Bug 1235475 for CVE-2024-12747",
"url": "https://bugzilla.suse.com/1235475"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Proxy 4.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Micro 5.5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Proxy 4.3:rsync-3.2.3-150400.3.17.1.x86_64",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.ppc64le",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.s390x",
"SUSE Manager Server 4.3:rsync-3.2.3-150400.3.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-17T16:09:34Z",
"details": "moderate"
}
],
"title": "CVE-2024-12747"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…