Summary
Koen van Hove discovered that the rsync client incorrectly validated
filenames returned by servers. If a user or automated system were tricked
into connecting to a malicious server, a remote attacker could use this
issue to write arbitrary files, and possibly escalate privileges.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | rsync | 3.1.2-2.1ubuntu1.6 |
| Ubuntu · 20.04 LTS 20.04:LTS | rsync | 3.1.3-8ubuntu0.5 |
| Ubuntu · 22.04 LTS 22.04:LTS | rsync | 3.2.7-0ubuntu0.22.04.2 |
Vulnerabilities 1
-
Unscored —CVE-2022-29154 Public exploit
An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the …
References
-
report
https://ubuntu.com/security/CVE-2022-29154