Rsync: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 6

• Critical 9.8
  CVE-2024-12084 Public exploit EPSS 73%

  Rsync: heap buffer overflow in rsync due to improper checksum length handling

  A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of b…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Jan 15, 2025
• High 7.5
  CVE-2024-12085 Public exploit

  Rsync: info leak via uninitialized stack contents

  A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitializ…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux Alpine
  Jan 14, 2025
• Medium 6.5
  CVE-2024-12087

  Rsync: path traversal vulnerability in rsync

  A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--i…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux Alpine
  Jan 14, 2025
• Medium 6.5
  CVE-2024-12088

  Rsync: --safe-links option bypass leads to path traversal

  A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Jan 14, 2025
• Medium 6.1
  CVE-2024-12086

  Rsync: rsync server leaks arbitrary client files

  A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Jan 14, 2025
• Medium 5.6
  CVE-2024-12747

  Rsync: race condition in rsync handling symbolic links

  A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Jan 14, 2025

Revision history

1. 2026-10-04 #52

   Neue Updates von IBM aufgenommen

2. 2026-09-03 #51

   Neue Updates von Dell aufgenommen

3. 2026-08-31 #50

   Neue Updates von Dell aufgenommen

4. 2026-08-03 #49

   Neue Updates von Oracle Linux aufgenommen

5. 2026-06-29 #48

   Neue Updates von Oracle Linux aufgenommen

6. 2026-06-24 #47

   Neue Updates von Red Hat aufgenommen

7. 2026-05-27 #46

   Neue Updates von SUSE aufgenommen

8. 2026-05-25 #45

   Neue Updates von SUSE und Red Hat aufgenommen

9. 2026-05-21 #44

   Neue Updates von SUSE aufgenommen

10. 2026-05-19 #43

    Neue Updates von Red Hat aufgenommen

11. 2026-01-21 #42

    Neue Updates von Red Hat aufgenommen

12. 2026-01-05 #41

    Neue Updates von Oracle Linux aufgenommen

13. 2026-01-04 #40

    Neue Updates von IBM aufgenommen

14. 2025-12-22 #39

    Neue Updates von Red Hat aufgenommen

15. 2025-12-21 #38

    Neue Updates von Red Hat aufgenommen

16. 2025-12-16 #37

    Neue Updates von Red Hat aufgenommen

17. 2025-12-15 #36

    Neue Updates von Red Hat aufgenommen

18. 2025-12-14 #35

    Neue Updates von Red Hat aufgenommen

19. 2025-11-27 #34

    Neue Updates von Meinberg aufgenommen

20. 2025-11-20 #33

    Neue Updates von Red Hat aufgenommen

21. 2025-10-01 #32

    Neue Updates von Dell aufgenommen

22. 2025-07-09 #31

    Neue Updates aufgenommen

23. 2025-06-03 #30

    Neue Updates von SUSE aufgenommen

24. 2025-06-02 #29

    Neue Updates von XEROX aufgenommen

25. 2025-05-29 #28

    Neue Updates von Red Hat aufgenommen

References

• VU#952657: Rsync contains six vulnerabilities vom 2025-01-14
  https://kb.cert.org/vuls/id/952657
• Fedora Security Advisory FEDORA-2025-73C1F25730 vom 2025-01-14
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-73c1f25730
• Arch Linux Security Advisory ASA-202501-1 vom 2025-01-14
  https://security.archlinux.org/ASA-202501-1
• Debian Security Advisory DSA-5843 vom 2025-01-14
  https://lists.debian.org/debian-security-announce/2025/msg00004.html
• Debian Security Advisory DLA-4015 vom 2025-01-14
  https://lists.debian.org/debian-lts-announce/2025/01/msg00008.html
• Amazon Linux Security Advisory ALAS-2025-1954 vom 2025-01-15
  https://alas.aws.amazon.com/ALAS-2025-1954.html
• Amazon Linux Security Advisory ALAS-2025-2730 vom 2025-01-15
  https://alas.aws.amazon.com/AL2/ALAS-2025-2730.html
• Fedora Security Advisory FEDORA-2025-EC87287710 vom 2025-01-14
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-ec87287710
• Ubuntu Security Notice USN-7206-1 vom 2025-01-14
  https://ubuntu.com/security/notices/USN-7206-1
• Red Hat Security Advisory RHSA-2025:0324 vom 2025-01-15
  https://access.redhat.com/errata/RHSA-2025:0324
• Red Hat Security Advisory RHSA-2025:0325 vom 2025-01-15
  https://access.redhat.com/errata/RHSA-2025:0325
• SUSE Security Update SUSE-SU-2025:0118-2 vom 2025-01-15
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/4BRNRPJ3VCRVJMGFGC5EPYWUJTTXNY57/
• SUSE Security Update SUSE-SU-2025:0121-2 vom 2025-01-15
  https://lists.suse.com/pipermail/sle-security-updates/2025-January/020135.html
• SUSE Security Update SUSE-SU-2025:0122-2 vom 2025-01-15
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FDJSS5UVGBZXCNVBX4FQ77W4TUNRVECV/
• SUSE Security Update SUSE-SU-2025:0118-2 vom 2025-01-15
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4BRNRPJ3VCRVJMGFGC5EPYWUJTTXNY57/
• SUSE Security Update SUSE-SU-2025:0122-2 vom 2025-01-15
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/FDJSS5UVGBZXCNVBX4FQ77W4TUNRVECV/
• SUSE Security Update SUSE-SU-2025:0118-1 vom 2025-01-15
  https://lists.suse.com/pipermail/sle-security-updates/2025-January/020130.html
• Oracle Linux Security Advisory ELSA-2025-0325 vom 2025-01-15
  https://linux.oracle.com/errata/ELSA-2025-0325.html
• Oracle Linux Security Advisory ELSA-2025-0324 vom 2025-01-15
  https://linux.oracle.com/errata/ELSA-2025-0324.html
• Gentoo Linux Security Advisory GLSA-202501-01 vom 2025-01-15
  https://security.gentoo.org/glsa/202501-01
• SUSE Security Update SUSE-SU-2025:0122-1 vom 2025-01-15
  https://lists.suse.com/pipermail/sle-security-updates/2025-January/020127.html
• SUSE Security Update SUSE-SU-2025:0121-1 vom 2025-01-15
  https://lists.suse.com/pipermail/sle-security-updates/2025-January/020128.html
• SUSE Security Update SUSE-SU-2025:0120-1 vom 2025-01-15
  https://lists.suse.com/pipermail/sle-security-updates/2025-January/020129.html
• SUSE Security Update SUSE-SU-2025:0120-2 vom 2025-01-15
  https://lists.suse.com/pipermail/sle-security-updates/2025-January/020137.html
• SUSE Security Update SUSE-SU-2025:0122-2 vom 2025-01-15
  https://lists.suse.com/pipermail/sle-security-updates/2025-January/020136.html
• Amazon Linux Security Advisory ALAS-2025-2731 vom 2025-01-17
  https://alas.aws.amazon.com/AL2/ALAS-2025-2731.html
• Ubuntu Security Notice USN-7206-2 vom 2025-01-16
  https://ubuntu.com/security/notices/USN-7206-2
• Amazon Linux Security Advisory ALAS-2025-1955 vom 2025-01-17
  https://alas.aws.amazon.com/ALAS-2025-1955.html
• Fedora Security Advisory FEDORA-2025-3EC637E6E9 vom 2025-01-16
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-3ec637e6e9
• SUSE Security Update SUSE-SU-2025:0166-1 vom 2025-01-17
  https://lists.suse.com/pipermail/sle-security-updates/2025-January/020167.html
• SUSE Security Update SUSE-SU-2025:0165-1 vom 2025-01-17
  https://lists.suse.com/pipermail/sle-security-updates/2025-January/020168.html
• SUSE Security Update SUSE-SU-2025:0156-1 vom 2025-01-17
  https://lists.suse.com/pipermail/sle-security-updates/2025-January/020160.html
• Rocky Linux Security Advisory RLSA-2025:0325 vom 2025-01-17
  https://errata.build.resf.org/RLSA-2025:0325
• SUSE Security Update SUSE-SU-2025:0157-1 vom 2025-01-17
  https://lists.suse.com/pipermail/sle-security-updates/2025-January/020159.html
• HAProxy Security Update vom 2025-01-22
  https://www.haproxy.com/blog/january-2025-multiple-rsync-cves-impacting-memory-and-file-handling-in-linux-virtual-images
• Red Hat Security Advisory RHSA-2025:0637 vom 2025-01-23
  https://access.redhat.com/errata/RHSA-2025:0637
• Google Container-Optimized OS Release Notes, Stand vom 2025-01-23
  https://cloud.google.com/container-optimized-os/docs/release-notes/dev
• Red Hat Security Advisory RHSA-2025:0688 vom 2025-01-27
  https://access.redhat.com/errata/RHSA-2025:0688
• Red Hat Security Advisory RHSA-2025:0714 vom 2025-01-27
  https://access.redhat.com/errata/RHSA-2025:0714
• Red Hat Security Advisory RHSA-2025:0783 vom 2025-01-28
  https://access.redhat.com/errata/RHSA-2025:0783
• Ubuntu Security Notice USN-7206-3 vom 2025-01-28
  https://ubuntu.com/security/notices/USN-7206-3
• Red Hat Security Advisory RHSA-2025:0787 vom 2025-01-29
  https://access.redhat.com/errata/RHSA-2025:0787
• Red Hat Security Advisory RHSA-2025:0774 vom 2025-01-28
  https://access.redhat.com/errata/RHSA-2025:0774
• Red Hat Security Advisory RHSA-2025:0790 vom 2025-01-30
  https://rhn.redhat.com/errata/RHSA-2025:0790.html
• Red Hat Security Advisory RHSA-2025:0849 vom 2025-01-30
  https://access.redhat.com/errata/RHSA-2025:0849
• Red Hat Security Advisory RHSA-2025:0884 vom 2025-02-03
  https://access.redhat.com/errata/RHSA-2025:0884
• Red Hat Security Advisory RHSA-2025:0885 vom 2025-02-03
  https://access.redhat.com/errata/RHSA-2025:0885
• Red Hat Security Advisory RHSA-2025:0875 vom 2025-02-05
  https://access.redhat.com/errata/RHSA-2025:0875
• Red Hat Security Advisory RHSA-2025:0827 vom 2025-02-06
  https://access.redhat.com/errata/RHSA-2025:0827
• Red Hat Security Advisory RHSA-2025:0831 vom 2025-02-06
  https://access.redhat.com/errata/RHSA-2025:0831
• Red Hat Security Advisory RHSA-2025:0876 vom 2025-02-05
  https://access.redhat.com/errata/RHSA-2025:0876
• Red Hat Security Advisory RHSA-2025:0840 vom 2025-02-06
  https://access.redhat.com/errata/RHSA-2025:0840
• Ubuntu Security Notice USN-7206-4 vom 2025-02-10
  https://ubuntu.com/security/notices/USN-7206-4
• Red Hat Security Advisory RHSA-2025:1128 vom 2025-02-12
  https://access.redhat.com/errata/RHSA-2025:1128
• Red Hat Security Advisory RHSA-2025:1120 vom 2025-02-11
  https://access.redhat.com/errata/RHSA-2025:1120
• Red Hat Security Advisory RHSA-2025:1123 vom 2025-02-12
  https://access.redhat.com/errata/RHSA-2025:1123
• Red Hat Security Advisory RHSA-2025:1227 vom 2025-02-12
  https://access.redhat.com/errata/RHSA-2025:1227
• Red Hat Security Advisory RHSA-2025:1225 vom 2025-02-12
  https://access.redhat.com/errata/RHSA-2025:1225
• Red Hat Security Advisory RHSA-2025:1242 vom 2025-02-13
  https://access.redhat.com/errata/RHSA-2025:1242
• Oracle Linux Security Advisory ELSA-2025-0714 vom 2025-02-14
  https://linux.oracle.com/errata/ELSA-2025-0714.html
• IBM Security Bulletin 7183584 vom 2025-02-18
  https://www.ibm.com/support/pages/node/7183584
• Red Hat Security Advisory RHSA-2025:1451 vom 2025-02-19
  https://access.redhat.com/errata/RHSA-2025:1451
• PoC auf GitHub vom 2025-02-25
  https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj
• Red Hat Security Advisory RHSA-2025:2600 vom 2025-03-11
  https://access.redhat.com/errata/RHSA-2025:2600
• Oracle Linux Security Advisory ELSA-2025-2600 vom 2025-03-11
  https://linux.oracle.com/errata/ELSA-2025-2600.html
• Red Hat Security Advisory RHSA-2025:2701 vom 2025-03-20
  https://access.redhat.com/errata/RHSA-2025:2701
• SUSE Security Update SUSE-SU-2025:0991-1 vom 2025-03-24
  https://lists.suse.com/pipermail/sle-security-updates/2025-March/020585.html
• Red Hat Security Advisory RHSA-2025:3124 vom 2025-03-24
  https://access.redhat.com/errata/RHSA-2025:3124
• SUSE Security Update SUSE-SU-2025:1330-1 vom 2025-04-16
  https://lists.suse.com/pipermail/sle-security-updates/2025-April/020716.html
• Red Hat Security Advisory RHSA-2025:7050 vom 2025-05-13
  https://access.redhat.com/errata/RHSA-2025:7050
• Red Hat Security Advisory RHSA-2025:8278 vom 2025-05-29
  https://rhn.redhat.com/errata/RHSA-2025:8278.html
• Red Hat Security Advisory RHSA-2025:8274 vom 2025-05-28
  https://access.redhat.com/errata/RHSA-2025:8274
• Red Hat Security Advisory RHSA-2025:8278 vom 2025-05-28
  https://access.redhat.com/errata/RHSA-2025:8278
• Red Hat Security Advisory RHSA-2025:8274 vom 2025-05-29
  https://rhn.redhat.com/errata/RHSA-2025:8274.html
• Dell Security Advisory DSA-2025-213 vom 2025-05-30
  https://www.dell.com/support/kbdoc/de-de/000326299/dsa-2025-213-security-update-for-dell-avamar-dell-networker-virtual-edition-nve-and-dell-powerprotect-dp-series-appliance-dell-integrated-data-protection-appliance-idpa-multiple-third-party-vulnerabilities
• XEROX Security Advisory XRX25-012 vom 2025-06-02
  https://security.business.xerox.com/wp-content/uploads/2025/06/Xerox-Security-Bulletin-XRX25-012-for-Xerox-FreeFlow-Print-Server-v9.pdf
• SUSE Security Update SUSE-SU-2025:20223-1 vom 2025-06-04
  https://lists.suse.com/pipermail/sle-security-updates/2025-June/021107.html
• SUSE Security Update SUSE-SU-2025:20122-1 vom 2025-06-04
  https://lists.suse.com/pipermail/sle-security-updates/2025-June/021258.html
• GitLab Patch Release vom 2025-07-09
  https://about.gitlab.com/releases/2025/07/09/patch-release-gitlab-18-1-2-released/
• Red Hat Security Advisory RHSA-2025:23235 vom 2025-12-16
  https://access.redhat.com/errata/RHSA-2025:23235