Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-29154: A flaw was found in rsync that is triggered by a victim rsync user/client connecting to a malicious rsync server. The server can copy and overwrite arbitrary files in the client's rsync target directory and subdirectories. This flaw allows a malicious server, or in some cases, another attacker who performs a man-in-the-middle attack, to potentially overwrite sensitive files on the client machine, resulting in further exploitation.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | rsync | 0:3.1.2-11.amzn2.0.1 |
| Amazon Linux · 2 | rsync-debuginfo | 0:3.1.2-11.amzn2.0.1 |
Vulnerabilities 1
-
Unscored —CVE-2022-29154 Public exploit
An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-29154.html