Medium RHSA-2025:2600 3 CVEs

Red Hat Security Advisory: rsync security update

Published Mar 11, 2025 · Updated Jun 30, 2026

Ecosystem: Red Hat

Fixed packages 4

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::baseos	rsync	0:3.1.3-21.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos	rsync-daemon	0:3.1.3-21.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos	rsync-debuginfo	0:3.1.3-21.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos	rsync-debugsource	0:3.1.3-21.el8_10

Vulnerabilities 3

Medium 6.5

CVE-2024-12087

Rsync: path traversal vulnerability in rsync

A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--i…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux Alpine

Jan 14, 2025
Medium 6.5

CVE-2024-12088

Rsync: --safe-links option bypass leads to path traversal

A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may …

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine

Jan 14, 2025
Medium 5.6

CVE-2024-12747

Rsync: race condition in rsync handling symbolic links

A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine

Jan 14, 2025

References

article
https://access.redhat.com/security/updates/classification/#moderate
report
https://bugzilla.redhat.com/show_bug.cgi?id=2330672
report
https://bugzilla.redhat.com/show_bug.cgi?id=2330676
report
https://bugzilla.redhat.com/show_bug.cgi?id=2332968
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2600.json
report
https://access.redhat.com/security/cve/CVE-2024-12087
advisory
https://www.cve.org/CVERecord?id=CVE-2024-12087
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-12087
article
https://kb.cert.org/vuls/id/952657
report
https://access.redhat.com/security/cve/CVE-2024-12088
advisory
https://www.cve.org/CVERecord?id=CVE-2024-12088
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-12088
report
https://access.redhat.com/security/cve/CVE-2024-12747
advisory
https://www.cve.org/CVERecord?id=CVE-2024-12747
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-12747