CVE-2022-29154

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).

Rsync is an open source utility that provides fast incremental file transfer.It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).(CVE-2022-29154)

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

• rsync: remote arbitrary files write inside the directories of connecting peers (CVE-2022-29154)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

• rsync: remote arbitrary files write inside the directories of connecting peers (CVE-2022-29154)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es):

• rsync: remote arbitrary files write inside the directories of connecting peers (CVE-2022-29154) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2022-29154: fix arbitrary file write vulnerability via malicious rysnc server (MITM attack)

• CVE-2022-29154: fix arbitrary file write vulnerability via malicious rysnc server (MITM attack)

• CVE-2022-29154: fix arbitrary file write vulnerability via malicious rysnc server (MITM attack)
• Add '%check unset DISPLAY ' section but disable broken 'daemon' and 'hardlinks' tests

• SECURITY UPDATE: arbitrary file write vulnerability via malicious rysnc server (MITM attack)
  • debian/patches/CVE-2022-29154.patch: add extra file-list safety checks.
  • CVE-2022-29154
• Fix noatime patch to build the testsuite and enable it in debian/rules

• CVE-2022-29154: fix arbitrary file write vulnerability via malicious rysnc server (MITM attack)
• Add '%check unset DISPLAY ' section but disable broken 'daemon' and 'hardlinks' tests

• CVE-2022-29154: refactoring due to broken command line arguments parsing

• CVE-2022-29154: refactoring due to broken command line arguments parsing

• CVE-2022-29154: refactoring due to broken command line arguments parsing

• SECURITY UPDATE: arbitrary file write vulnerability via malicious rsync server (MITM attack), refactoring
  • debian/patches/CVE-2022-29154-0.patch: prepare for CVE-2022-29154 patch
  • debian/patches/CVE-2022-29154-1.patch: add extra file-list safety checks
  • CVE-2022-29154

• CVE-2022-29154: fix arbitrary file write vulnerability via malicious rsync server (MITM attack), refactoring
• fix test-system components, enable 'daemon' and 'hardlinks' tests

• CVE-2022-29154: fix arbitrary file write vulnerability via malicious rsync server (MITM attack), refactoring
• fix test-system components, enable 'daemon' and 'hardlinks' tests

• SECURITY UPDATE: malicious remote servers to write arbitrary files inside the directories of connecting peers:
  • debian/patches/els/0001-CVE-2022-29154.patch: fix insufficient validation of file names.
  • CVE-2022-29154.
• SECURITY UPDATE: path traversal vulnerability.
  • debian/patches/els/0002-CVE-2024-12087.patch: refuse a duplicate dirlist and range check dir_ndx before use
  • CVE-2024-12087
• SECURITY UPDATE: rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it:
  • debian/patches/els/0003-CVE-2024-12088.patch: make --safe-links stricter.
  • CVE-2024-12088.

• SECURITY UPDATE: peer-driven one-byte heap out-of-bounds write in add_implied_include() from a files-from entry carrying both an interior and a trailing backslash:
  • debian/patches/els/0009-CVE-2026-70461.patch: count a trailing backslash when sizing the appended-wildcard pattern.
  • CVE-2026-70461.
• SECURITY UPDATE: heap out-of-bounds write in read_args() when the peer's argument count lands exactly on the argv allocation:
  • debian/patches/els/0010-CVE-2026-70456.patch: reserve room for the trailing NULL terminator.
  • CVE-2026-70456.
• SECURITY UPDATE: out-of-bounds write from a file entry marked FLAG_HLINKED that the receiver accepted with hard-link preservation inactive:
  • debian/patches/els/0011-CVE-2026-70458.patch: gate FLAG_HLINKED on preserve_hard_links and exclude directories.
  • CVE-2026-70458.
• SECURITY UPDATE: sender-side out-of-bounds read driven by a malicious receiver's checksum header with a non-zero block count and a zero block length:
  • debian/patches/els/0012-CVE-2026-53792.patch: reject a zero block length in read_sum_head().
  • CVE-2026-53792.
• SECURITY UPDATE: CPU exhaustion in the sending process via quadratic-time behaviour in hash_search(), driven by a malicious receiver's crafted equal-weak-checksum block list. The attacker is the receiver, but the cycles burned are the sender's: hash_search() is reached only through match_sums(), whose sole caller is send_files() in sender.c. NVD's text attributes the CPU to the receiver; the direction stated here is what the code does:
  • debian/patches/els/0013-CVE-2026-70453.patch: bound the per-offset chain walk.
  • CVE-2026-70453.
• SECURITY UPDATE: daemon "hosts deny" failing open when a configured hostname token cannot be resolved:
  • debian/patches/els/0014-CVE-2026-70452.patch: treat an unresolvable deny-list token as a match.
  • CVE-2026-70452.
• SECURITY UPDATE: daemon "auth users" ignoring its documented comma-only parsing, silently discarding a deny rule that names a group whose name contains a space:
  • debian/patches/els/0015-CVE-2026-70463.patch: parse the list with conf_strtok().
  • CVE-2026-70463.
• SECURITY UPDATE: peer-supplied MSG_IO_TIMEOUT disabling the client's own I/O timeout through a non-positive or overflowing value:
  • debian/patches/els/0016-CVE-2026-70462.patch: cap the received value and make set_io_timeout() arithmetic overflow-safe.
  • CVE-2026-70462.
• SECURITY UPDATE: client-supplied --filter merge file bypassing the daemon module filter list:
  • debian/patches/els/0017-CVE-2026-53786.patch: strip the module-dir prefix before the daemon-filter check.
  • CVE-2026-53786.
• SECURITY UPDATE: per-connection daemon child crash on a crafted first incremental file list whose transfer root is a non-directory dot entry:
  • debian/patches/els/0018-CVE-2026-70459.patch: reject a non-directory transfer-root entry and require a dir_flist entry before trusting parent_ndx 0.
  • CVE-2026-70459.
• SECURITY UPDATE: malicious sender widening the receiver's --delete scope beyond the destination subtree via implied-parent reclassification:
  • debian/patches/els/0019-CVE-2026-53789.patch: force implied-parent directories non-content on the receiver, including the synthetic transfer root and the pre-protocol-30 encoding.
  • CVE-2026-53789.
• SECURITY UPDATE: unauthenticated pre-transfer handshake stall holding a per-connection daemon child past the module's max connections limit:
  • debian/patches/els/0020-CVE-2026-70464.patch: bound every peer-controlled handshake read with an absolute deadline and cap the early-protocol argument count.
  • CVE-2026-70464.
• SECURITY UPDATE: command and argument injection…

• SECURITY UPDATE: "auth users" authorization bypass on entries containing a space
  • debian/patches/CVE-2026-70463.patch: parse the "auth users" value with conf_strtok() in auth_server(), so the documented leading-comma form splits on commas alone and an "@Group Name:deny" entry is no longer torn in two -- discarding the deny rule and creating an implicit allow rule from its first word; import conf_strtok() into util.c, which this version does not yet carry; document the leading-comma form in rsyncd.conf.yo and in the pre-generated rsyncd.conf.5 (this tree ships no yodl2man, so only the .5 is installed), without which an admin is never told the form that activates the fix; and add testsuite/cve-2026-70463.test
  • CVE-2026-70463
• SECURITY UPDATE: daemon filter-merge bypass of the module filter list
  • debian/patches/CVE-2026-53786.patch: in parse_filter_file(), strip the module_dir prefix that parse_merge_name() prepended before checking a client-supplied --filter merge file against daemon_filter_list, so the anchored module-relative daemon rule can match; the strip is conditional on the prefix really being present so the daemon's own "include from" / "exclude from" and get_cvs_excludes() paths are not truncated; upstream's early return on a daemon-filter hit is deliberately not taken, since without v3.5.0's daemon_config_filter_file exemption it would silently drop the operator's own "include from" / "exclude from" rules and, without v3.5.0's name+errno suppression, would leave hidden merge files silent while missing ones stay fatal; add testsuite/cve-2026-53786.test
  • CVE-2026-53786
• SECURITY UPDATE: daemon NULL dereference on a non-directory first file-list entry
  • debian/patches/CVE-2026-70459.patch: reject a "." or "/." transfer-root entry whose mode is not a directory in recv_file_entry(), and require dir_flist to actually hold an entry in recv_file_list() before trusting parent_ndx 0, closing the wild-pointer read that crashes the per-connection daemon child
  • CVE-2026-70459
• SECURITY UPDATE: --delete scope widening via implied-parent reclassification
  • debian/patches/CVE-2026-53789.patch: add is_implied_parent_dir() to exclude.c and use it in recv_file_entry() to force an implied parent back to the honest XMIT_TOP_DIR | XMIT_NO_CONTENT_DIR encoding, on both the protocol >= 30 and the legacy protocol < 30 paths, so it lands in FLAG_IMPLIED_DIR and delete_in_dir() cannot sweep pre-existing siblings outside the intended destination subtree
  • debian/patches/CVE-2022-29154-2.patch: drop the trailing slash in add_implied_include(), completing the upstream CVE-2022-29154 series this branch carries, so a "src/dir/" argument seeds the requested leaf as a plain include rule instead of a FILTRULE_DIRECTORY one; without it is_implied_parent_dir() would classify the explicitly requested directory as an implied parent and --delete would stop pruning it
  • CVE-2026-53789

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file). (CVE-2022-29154)

These are all security issues fixed in the rsync-3.2.4-3.1 package on the GA media of openSUSE Tumbleweed.

This update for rsync fixes the following issues:

• Update to version 3.2.3 (jsc#SLE-21252, jsc#PED-3146)
• Add support for using --atimes to preserve atime of files in destination sync (jsc#PED-3145)
• Remove SuSEfirewall2 service as this was replaced by firewalld (which already provides a rsyncd service).
• Fix --delay-updates never updates after interruption (bsc#1204538)
• Arbitrary file write vulnerability via do_server_recv function (bsc#1201840, CVE-2022-29154)
• rsync-ssl: Verify the hostname in the certificate when using openssl. (bsc#1176160, CVE-2020-14387)

This update for rsync fixes the following issues:

• CVE-2022-29154: Fixed an arbitrary file write when connecting to a malicious server (bsc#1201840).

This update for rsync fixes the following issues:

• CVE-2022-29154: Fixed an arbitrary file write issue that could be triggered by a malicious remote server (bsc#1201840).

This update for rsync fixes the following issues:

• CVE-2022-29154: Fixed an arbitrary file write issue that could be triggered by a malicious remote server (bsc#1201840).

This update for rsync fixes the following issues:

• CVE-2022-29154: Fixed an arbitrary file write issue that could be triggered by a malicious remote server (bsc#1201840).

This update for rsync fixes the following issues:

• CVE-2022-29154: Fixed an arbitrary file write issue that could be triggered by a malicious remote server (bsc#1201840).

This update for rsync fixes the following issues

Security issues:

• CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
• CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
• CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
• CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
• CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
• CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).

Non security issues:

• rsync --delay-updates never updates after interruption (bsc#1204538).
• Fix duplication of flag causing illegal hashkey failures.

Koen van Hove discovered that the rsync client incorrectly validated filenames returned by servers. If a user or automated system were tricked into connecting to a malicious server, a remote attacker could use this issue to write arbitrary files, and possibly escalate privileges.