Skip to content
OpenAdvisories
Medium ALAS2023-2025-1302 1 CVE

Moderate: rsync security update (Amazon Linux 2023)

Published Dec 8, 2025 · Updated Dec 8, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-10158: A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger the issue.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2023 rsync 0:3.4.0-1.amzn2023.0.3
Amazon Linux · 2023 rsync-daemon 0:3.4.0-1.amzn2023.0.3
Amazon Linux · 2023 rsync-debuginfo 0:3.4.0-1.amzn2023.0.3
Amazon Linux · 2023 rsync-debugsource 0:3.4.0-1.amzn2023.0.3

Vulnerabilities 1

  • Medium 4.3
    CVE-2025-10158

    Rsync: Out of bounds array access via negative index

    A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger t…

    rsync rsync rsync rsync Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-10158.html