Summary
The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.
Security Fix(es):
* rsync: rsync server leaks arbitrary client files (CVE-2024-12086)
* rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | rsync | 3.2.5-7.el9_8 |
| AlmaLinux · 9 | rsync-daemon | 3.2.5-7.el9_8 |
| AlmaLinux · 9 | rsync-rrsync | 3.2.5-7.el9_8 |
Vulnerabilities 2
-
High 7.4
In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a recei…
-
Medium 6.1
Rsync: rsync server leaks arbitrary client files
A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of …