Debian Rsync vulnerabilities

CVE-2024-12084 [CRITICAL] CVE-2024-12084: rsync - A heap-based buffer overflow flaw was found in the rsync daemon. This issue is d... A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer. Scope: local bookworm: resolved (fixed in 3.2.7-1+deb12u1) bullseye: resolved for

CVE-2017-17434 [CRITICAL] CVE-2017-17434: rsync - The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not che... The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv_files function in receiver.c) and also does not apply the sanitize_paths protection mechanism to pathnames found in "xname follows" strings (in the read_ndx_and_attrs function in rsync.c), which allows remo

CVE-2024-12085 [HIGH] CVE-2024-12085: rsync - A flaw was found in rsync which could be triggered when rsync compares file chec... A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time. Scope: local bookworm: resolved (fixed in 3.2.7-1+deb12u1) bullseye: resolved (fixed i

CVE-2024-12087 [MEDIUM] CVE-2024-12087: rsync - A path traversal vulnerability exists in rsync. It stems from behavior enabled b... A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a

CVE-2024-12088 [MEDIUM] CVE-2024-12088: rsync - A flaw was found in rsync. When using the `--safe-links` option, the rsync clien... A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory. Scope: local bookworm: resolved (fixed in 3.2.7-1

CVE-2003-0962 [HIGH] CVE-2003-0962: rsync - Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, a... Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, allows remote attackers to execute arbitrary code and possibly escape the chroot jail. Scope: local bookworm: resolved (fixed in 2.5.6-1.1) bullseye: resolved (fixed in 2.5.6-1.1) forky: resolved (fixed in 2.5.6-1.1) sid: resolved (fixed in 2.5.6-1.1) trixie: resolved (fixed in 2.5.6-1.1)

CVE-2022-29154 [HIGH] CVE-2022-29154: rsync - An issue was discovered in rsync before 3.2.5 that allows malicious remote serve... An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitr

CVE-2018-5764 [HIGH] CVE-2018-5764: rsync - The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does n... The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers to bypass an argument-sanitization protection mechanism. Scope: local bookworm: resolved (fixed in 3.1.2-2.2) bullseye: resolved (fixed in 3.1.2-2.2) forky: resolved (fixed in 3.1.2-2.2) sid: resolved (fixed in 3.1.2-2.2)

CVE-2016-9841 [CRITICAL] CVE-2016-9841: rsync - inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecif... inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. Scope: local bookworm: resolved (fixed in 3.1.3-6) bullseye: resolved (fixed in 3.1.3-6) forky: resolved (fixed in 3.1.3-6) sid: resolved (fixed in 3.1.3-6) trixie: resolved (fixed in 3.1.3-6)

CVE-2007-6200 [CRITICAL] CVE-2007-6200: rsync - Unspecified vulnerability in rsync before 3.0.0pre6, when running a writable rsy... Unspecified vulnerability in rsync before 3.0.0pre6, when running a writable rsync daemon, allows remote attackers to bypass exclude, exclude_from, and filter and read or write hidden files via (1) symlink, (2) partial-dir, (3) backup-dir, and unspecified (4) dest options. Scope: local bookworm: resolved (fixed in 2.6.9-6) bullseye: resolved (fixed in 2.6.9-6) forky

CVE-2014-9512 [MEDIUM] CVE-2014-9512: rsync - rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink at... rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path. Scope: local bookworm: resolved (fixed in 3.1.1-3) bullseye: resolved (fixed in 3.1.1-3) forky: resolved (fixed in 3.1.1-3) sid: resolved (fixed in 3.1.1-3) trixie: resolved (fixed in 3.1.1-3)

CVE-2017-16548 [CRITICAL] CVE-2017-16548: rsync - The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does... The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon. Scope: local bookworm: resolved (fi

CVE-2024-12086 [MEDIUM] CVE-2024-12086: rsync - A flaw was found in rsync. It could allow a server to enumerate the contents of ... A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By s

CVE-2007-6199 [CRITICAL] CVE-2007-6199: rsync - rsync before 3.0.0pre6, when running a writable rsync daemon that is not using c... rsync before 3.0.0pre6, when running a writable rsync daemon that is not using chroot, allows remote attackers to access restricted files via unknown vectors that cause rsync to create a symlink that points outside of the module's hierarchy. Scope: local bookworm: resolved (fixed in 2.6.9-6) bullseye: resolved (fixed in 2.6.9-6) forky: resolved (fixed in 2.6.9-6) si

CVE-2016-9842 [HIGH] CVE-2016-9842: rsync - The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependen... The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers. Scope: local bookworm: resolved (fixed in 3.1.3-6) bullseye: resolved (fixed in 3.1.3-6) forky: resolved (fixed in 3.1.3-6) sid: resolved (fixed in 3.1.3-6) trixie: resolved (fixed in 3.1.3-6)

CVE-2016-9840 [HIGH] CVE-2016-9840: rsync - inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspeci... inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. Scope: local bookworm: resolved (fixed in 3.1.3-6) bullseye: resolved (fixed in 3.1.3-6) forky: resolved (fixed in 3.1.3-6) sid: resolved (fixed in 3.1.3-6) trixie: resolved (fixed in 3.1.3-6)

CVE-2020-14387 [HIGH] CVE-2020-14387: rsync - A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validate... A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The hi

CVE-2016-9843 [CRITICAL] CVE-2016-9843: rsync - The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent at... The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation. Scope: local bookworm: resolved (fixed in 3.1.3-6) bullseye: resolved (fixed in 3.1.3-6) forky: resolved (fixed in 3.1.3-6) sid: resolved (fixed in 3.1.3-6) trixie: resolved (fixed in 3.1.3-6)

CVE-2008-1720 [HIGH] CVE-2008-1720: rsync - Buffer overflow in rsync 2.6.9 to 3.0.1, with extended attribute (xattr) support... Buffer overflow in rsync 2.6.9 to 3.0.1, with extended attribute (xattr) support enabled, might allow remote attackers to execute arbitrary code via unknown vectors. Scope: local bookworm: resolved (fixed in 3.0.2-1) bullseye: resolved (fixed in 3.0.2-1) forky: resolved (fixed in 3.0.2-1) sid: resolved (fixed in 3.0.2-1) trixie: resolved (fixed in 3.0.2-1)

CVE-2004-2093 [MEDIUM] CVE-2004-2093: rsync - Buffer overflow in the open_socket_out function in socket.c for rsync 2.5.7 and ... Buffer overflow in the open_socket_out function in socket.c for rsync 2.5.7 and earlier allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long RSYNC_PROXY environment variable. NOTE: since rsync is not setuid, this issue does not provide any additional privileges beyond those that are already available to the user. There