Summary
[3.2.5-3]
- Resolves: RHEL-70265 - Rebase rsync to 3.2.5
[3.2.5-2]
- Resolves: RHEL-70158 - Info Leak via Uninitialized Stack Contents
- Resolves: RHEL-70208 - Path traversal vulnerability in rsync
- Resolves: RHEL-70210 - --safe-links option bypass leads to path traversal
- Resolves: RHEL-71657 - Race Condition in rsync Handling Symbolic Links
[3.2.3-21]
- Resolves: RHEL-70265 - Rebase rsync to 3.2.5
- Resolves: RHEL-67142 - Wrong progress reported by rsync when using copy-devices
- Resolves: RHEL-29340 - Slowness in rsync due to extra validation steps.
- Resolves: RHEL-18216 - rysnc script /usr/share/doc/rsync/support/rrsync is unsecure
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | rsync | 0:3.2.5-3.el9 |
| Oracle Linux · 9 | rsync-daemon | 0:3.2.5-3.el9 |
| Oracle Linux · 9 | rsync-rrsync | 0:3.2.5-3.el9 |
Vulnerabilities 3
-
Medium 6.5
Rsync: path traversal vulnerability in rsync
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--i…
-
Medium 6.5
Rsync: --safe-links option bypass leads to path traversal
A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may …
-
Medium 5.6
Rsync: race condition in rsync handling symbolic links
A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the…