CVE-2024-12088

A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.

A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client.

A path traversal vulnerability exists in rsync. It stems from behavior enabled by the --inc-recursive option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the --inc-recursive option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.

A flaw was found in rsync. When using the --safe-links option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.

A flaw was found in rsync. When using the --safe-links option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.

A flaw was found in rsync. When using the --safe-links option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.

Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

(CVE-2024-12085)

(CVE-2024-12086)

(CVE-2024-12087)

(CVE-2024-12088)

(CVE-2024-12747)

Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

(CVE-2024-12084)

(CVE-2024-12085)

(CVE-2024-12086)

(CVE-2024-12087)

(CVE-2024-12088)

(CVE-2024-12747)

Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

(CVE-2024-12085)

(CVE-2024-12086)

(CVE-2024-12087)

(CVE-2024-12088)

(CVE-2024-12747)

Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

(CVE-2024-12085)

(CVE-2024-12086)

(CVE-2024-12087)

(CVE-2024-12088)

(CVE-2024-12747)

Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

(CVE-2024-12084)

(CVE-2024-12085)

(CVE-2024-12086)

(CVE-2024-12087)

(CVE-2024-12088)

(CVE-2024-12747)

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

• rsync: Path traversal vulnerability in rsync (CVE-2024-12087)

• rsync: --safe-links option bypass leads to path traversal (CVE-2024-12088)

• rsync: Race Condition in rsync Handling Symbolic Links (CVE-2024-12747)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

• rsync: Path traversal vulnerability in rsync (CVE-2024-12087)

• rsync: --safe-links option bypass leads to path traversal (CVE-2024-12088)

• rsync: Race Condition in rsync Handling Symbolic Links (CVE-2024-12747)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

A flaw was found in rsync. When using the --safe-links option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

• rsync: Path traversal vulnerability in rsync (CVE-2024-12087)
• rsync: --safe-links option bypass leads to path traversal (CVE-2024-12088)
• rsync: Race Condition in rsync Handling Symbolic Links (CVE-2024-12747)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

• rsync: Path traversal vulnerability in rsync (CVE-2024-12087)
• rsync: --safe-links option bypass leads to path traversal (CVE-2024-12088)
• rsync: Race Condition in rsync Handling Symbolic Links (CVE-2024-12747)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

A flaw was found in rsync. When using the --safe-links option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.

A flaw was found in rsync. When using the --safe-links option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.

• CVE-2024-12088: fix path traversal vulnerability by properly verifying symbolic link destinations
• CVE-2024-12085: fix issue with checksum length manipulation leading to uninitialized memory leak

• CVE-2024-12088: fix path traversal vulnerability by properly verifying symbolic link destinations
• CVE-2024-12085: fix issue with checksum length manipulation leading to uninitialized memory leak

• SECURITY UPDATE: possible information leak via checksum comparison
  • debian/patches/CVE-2024-12086.patch: fix info leak when connecting to malicious server
  • CVE-2024-12086
• SECURITY UPDATE: arbitraty file write via inproper symlink verification
  • debian/patches/CVE-2024-12087.patch: fix writing malicious files to arbitrary locations when using '--inc-recursive' option
  • CVE-2024-12087
• SECURITY UPDATE: arbitraty file write when using '--safe-links' option
  • debian/patches/CVE-2024-12088.patch: properly verify if a symbolic link destination contains another symbolic link within it when using the '--safe-links' option
  • CVE-2024-12088

• SECURITY UPDATE: path traversal vulnerability via improper symlink verification, when using the --safe-links option
  • debian/patches/CVE-2024-12088.patch: make --safe-links stricter
  • CVE-2024-12088

• CVE-2024-12086: fix infoleak when connect to malicious server
• CVE-2024-12088: properly verify if a symbolic link destination contains another symbolic link within it when using the '--safe-links' option

• CVE-2024-12087: fix path traversal vulnerability in rsync enabled by the '--inc-recursive' option
• CVE-2024-12088: make --safe-links stricter

• CVE-2024-12087: fix path traversal vulnerability in rsync enabled by the '--inc-recursive' option
• CVE-2024-12088: make --safe-links stricter

• CVE-2024-12088: fix improper verification of symbolic link destinations to prevent path traversal vulnerability

• CVE-2024-12088: fix improper verification of symbolic link destinations to prevent path traversal vulnerability

• CVE-2024-12088: fix path traversal vulnerability in symbolic link destinations when using --safe-links option

• SECURITY UPDATE: malicious remote servers to write arbitrary files inside the directories of connecting peers:
  • debian/patches/els/0001-CVE-2022-29154.patch: fix insufficient validation of file names.
  • CVE-2022-29154.
• SECURITY UPDATE: path traversal vulnerability.
  • debian/patches/els/0002-CVE-2024-12087.patch: refuse a duplicate dirlist and range check dir_ndx before use
  • CVE-2024-12087
• SECURITY UPDATE: rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it:
  • debian/patches/els/0003-CVE-2024-12088.patch: make --safe-links stricter.
  • CVE-2024-12088.

Heap buffer overflow in rsync due to improper checksum length handling. (CVE-2024-12084) Info leak via uninitialized stack contents. (CVE-2024-12085) Rsync server leaks arbitrary client files. (CVE-2024-12086) Path traversal vulnerability in rsync. (CVE-2024-12087) Rsync --safe-links option bypass leads to path traversal. (CVE-2024-12088) Race condition in rsync handling symbolic links. (CVE-2024-12747)

These are all security issues fixed in the rsync-3.4.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for rsync fixes the following issues:

• CVE-2024-12084: heap buffer overflow in checksum parsing. (bsc#1234100)
• CVE-2024-12085: leak of uninitialized stack data on the server leading to possible ASLR bypass. (bsc#1234101)
• CVE-2024-12086: leak of a client machine's file contents through the processing of checksum data. (bsc#1234102)
• CVE-2024-12087: arbitrary file overwrite possible on clients when symlink syncing is enabled. (bsc#1234103)
• CVE-2024-12088: bypass of the --safe-links flag may allow the placement of unsafe symlinks in a client. (bsc#1234104)
• CVE-2024-12747: race condition in rsync handling symbolic links (bsc#1235475)

This update for rsync fixes the following issues:

• CVE-2024-12085: leak of uninitialized stack data on the server leading to possible ASLR bypass. (bsc#1234101)
• CVE-2024-12086: leak of a client machine's file contents through the processing of checksum data. (bsc#1234102)
• CVE-2024-12087: arbitrary file overwrite possible on clients when symlink syncing is enabled. (bsc#1234103)
• CVE-2024-12088: bypass of the --safe-links flag may allow the placement of unsafe symlinks in a client. (bsc#1234104)
• CVE-2024-12747: Fixed a race condition in rsync handling symbolic links. (bsc#1235475)

This update for rsync fixes the following issues:

• CVE-2024-12085: leak of uninitialized stack data on the server leading to possible ASLR bypass. (bsc#1234101)
• CVE-2024-12086: leak of a client machine's file contents through the processing of checksum data. (bsc#1234102)
• CVE-2024-12087: arbitrary file overwrite possible on clients when symlink syncing is enabled. (bsc#1234103)
• CVE-2024-12088: bypass of the --safe-links flag may allow the placement of unsafe symlinks in a client. (bsc#1234104)
• CVE-2024-12747: Fixed a race condition in rsync handling symbolic links. (bsc#1235475)

This update for rsync fixes the following issues:

• CVE-2024-12085: leak of uninitialized stack data on the server leading to possible ASLR bypass. (bsc#1234101)
• CVE-2024-12086: leak of a client machine's file contents through the processing of checksum data. (bsc#1234102)
• CVE-2024-12087: arbitrary file overwrite possible on clients when symlink syncing is enabled. (bsc#1234103)
• CVE-2024-12088: bypass of the --safe-links flag may allow the placement of unsafe symlinks in a client. (bsc#1234104)
• CVE-2024-12747: Fixed a race condition in handling symbolic links. (bsc#1235475)

This update for rsync fixes the following issues:

• Fixed bwlimit=0 option broken by CVE-2024-12088 fix (bsc#1239649).

This update for rsync fixes the following issues:

• CVE-2024-12084: Fixed Heap Buffer Overflow in Checksum Parsing (bsc#1234100).
• CVE-2024-12085: Fixed Info Leak via uninitialized Stack contents defeating ASLR (bsc#1234101).
• CVE-2024-12086: Fixed server leaking arbitrary client files (bsc#1234102).
• CVE-2024-12087: Fixed server use of symbolic links to make client write files outside of destination directory (bsc#1234103).
• CVE-2024-12088: Fixed --safe-links bypass (bsc#1234104).
• CVE-2024-12747: Fixed Race Condition in rsync Handling Symbolic Links (bsc#1235475).

This update for rsync fixes the following issues:

• Bump protocol version to 32 - make it easier to show server is patched.

• Fix FLAG_GOT_DIR_FLIST collission with FLAG_HLINKED

• Security update,CVE-2024-12747, bsc#1235475 race condition in handling symbolic links

• Security update, fix multiple vulnerabilities:

  • CVE-2024-12084, bsc#1234100 - Heap Buffer Overflow in Checksum Parsing
  • CVE-2024-12085, bsc#1234101 - Info Leak via uninitialized Stack contents defeats ASLR
  • CVE-2024-12086, bsc#1234102 - Server leaks arbitrary client files
  • CVE-2024-12087, bsc#1234103 - Server can make client write files outside of destination directory using symbolic links
  • CVE-2024-12088, bsc#1234104 - --safe-links Bypass

This update for rsync fixes the following issues

• CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
• CVE-2026-41035: Count of entries mismatch can lead to a use-after-free (bsc#1262223)
• CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
• CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
• CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
• CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
• CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).

This update for rsync fixes the following issues

• CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
• CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
• CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
• CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
• CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).

This update for rsync fixes the following issues

• CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
• CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
• CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
• CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
• CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
• CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).

This update for rsync fixes the following issues

Security issues:

• CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
• CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
• CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
• CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
• CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
• CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).

Non security issues:

• rsync --delay-updates never updates after interruption (bsc#1204538).
• Fix duplication of flag causing illegal hashkey failures.