Summary
[3.4.4-1]
- Resolves: RHEL-181630 - Rebase rsync to version 3.4.4
- Resolves: RHEL-174929 - TOCTOU symlink race condition (CVE-2026-29518)
- Resolves: RHEL-174949 - Memory disclosure via int overflow (CVE-2026-43618)
[3.4.1-3]
- Resolves: RHEL-118549 - Do not clear DISPLAY unconditionally
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | rsync | 0:3.4.4-1.el10_2 |
| Oracle Linux · 10 | rsync-daemon | 0:3.4.4-1.el10_2 |
| Oracle Linux · 10 | rsync-rrsync | 0:3.4.4-1.el10_2 |
Vulnerabilities 1
-
High 7.4
In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a recei…