Skip to content
OpenAdvisories
High ALAS2-2022-1873 1 CVE

Important: rsync security update (Amazon Linux 2)

Published Oct 31, 2022 · Updated Nov 8, 2022

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-29154: A flaw was found in rsync that is triggered by a victim rsync user/client connecting to a malicious rsync server. The server can copy and overwrite arbitrary files in the client's rsync target directory and subdirectories. This flaw allows a malicious server, or in some cases, another attacker who performs a man-in-the-middle attack, to potentially overwrite sensitive files on the client machine, resulting in further exploitation.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 rsync 0:3.1.2-11.amzn2.0.1
Amazon Linux · 2 rsync-debuginfo 0:3.1.2-11.amzn2.0.1

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-29154.html