Summary
[3.2.5-7.2]
- Fix integer overflow in compressed-token decoding (CVE-2026-43618)
- Resolves: RHEL-174932
[3.2.5-7.1]
- Fix TOCTOU symlink race in daemon no-chroot mode (CVE-2026-29518)
- Resolves: RHEL-174952
[3.2.5-4]
- Resolves: RHEL-104404 - Do not clear DISPLAY unconditionally
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | rsync | 0:3.2.5-7.el9_8.2 |
| Oracle Linux · 9 | rsync-daemon | 0:3.2.5-7.el9_8.2 |
| Oracle Linux · 9 | rsync-rrsync | 0:3.2.5-7.el9_8.2 |
Vulnerabilities 2
-
High 8.1
Rsync < 3.4.3 Integer Overflow Information Disclosure
Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and …
-
High 7.0
Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write
Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attacke…