{"id":"CVE-2014-8242","aliases":["DEBIAN-CVE-2014-8242","EUVD-2014-8083","GHSA-v3pp-49w5-gwmv","MGASA-2015-0146","SUSE-SU-2016:0173-1","SUSE-SU-2016:0176-1","UBUNTU-CVE-2014-8242","openSUSE-SU-2024:10257-1","openSUSE-SU-2024:10548-1"],"status":"published","title":"librsync before 1.0.0 uses a truncated MD4 checksum to match blocks, which makes it easier for...","description":"librsync before 1.0.0 uses a truncated MD4 checksum to match blocks, which makes it easier for remote attackers to modify transmitted data via a birthday attack.","severity":{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02939,"percentile":0.87201,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-310"],"published":"2015-04-15T09:01:28Z","modified":"2026-10-23T15:47:39Z","fixes":[{"ecosystem":"Debian:12","package":"librsync","fixed_in":["2.0.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"librsync","fixed_in":["2.0.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"librsync","fixed_in":["2.0.2-1"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"librsync","fixed_in":["1.0.0-2.2.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"duplicity","fixed_in":["0.6.22-5.1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"rdiff-backup","fixed_in":["1.3.3-8.1.mga4"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"librsync","fixed_in":["1.0.0-2.8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"librsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"librsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"librsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-1"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"librsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-2.2.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"duplicity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.22-5.1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"rdiff-backup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-8.1.mga4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-2.49.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-2.49.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-2.49.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-2.49.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-2.49.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-2.49.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-2.49.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"librsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.7-10"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"librsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.7-10","0.9.7-10build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"librsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-2.8"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-1.5"}]}],"bundled":4}],"products":[{"vendor":"librsync_project","product":"librsync"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152355.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-10/msg00034.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2014/08/05/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152366.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2014/07/28/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://security.gentoo.org/glsa/201605-04","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/librsync/librsync/issues/5","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2014/10/13/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://www.miknet.net/security/optimizing-birthday-attack/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151105.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://github.com/librsync/librsync/releases/tag/v1.0.0","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1126712","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8242"},{"url":"https://www.miknet.net/security/optimizing-birthday-attack"},{"url":"https://github.com/advisories/GHSA-v3pp-49w5-gwmv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-8242","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0146.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15543","tags":["report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2015-March/152366.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160173-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/898513","tags":["report"]},{"url":"https://bugzilla.suse.com/900914","tags":["report"]},{"url":"https://bugzilla.suse.com/915410","tags":["report"]},{"url":"https://bugzilla.suse.com/922710","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9512","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160176-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-8242","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2014/10/12","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8242","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2855","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-8242","description":"librsync before 1.0.0 uses a truncated MD4 checksum to match blocks, which makes it easier for remote attackers to modify transmitted data via a birthday attack.","status":"published","published":"2015-10-26T17:00:00Z","modified":"2024-08-06T13:10:51.182Z","updated_at":"2026-11-02T14:33:43.566796Z"}],"euvd":[{"id":"EUVD-2014-8083","description":"librsync before 1.0.0 uses a truncated MD4 checksum to match blocks, which makes it easier for remote attackers to modify transmitted data via a birthday attack.","status":"published","published":"2015-10-26T17:00:00Z","modified":"2024-08-06T13:10:51Z","updated_at":"2026-11-03T01:56:52.443165Z"}],"ghsa":[{"id":"GHSA-v3pp-49w5-gwmv","title":"librsync before 1.0.0 uses a truncated MD4 checksum to match blocks, which makes it easier for...","description":"librsync before 1.0.0 uses a truncated MD4 checksum to match blocks, which makes it easier for remote attackers to modify transmitted data via a birthday attack.","status":"published","published":"2022-05-13T01:26:30Z","modified":"2025-04-12T12:54:34Z","updated_at":"2026-11-02T15:01:24.215593Z"}],"nvd":[{"id":"CVE-2014-8242","description":"librsync before 1.0.0 uses a truncated MD4 checksum to match blocks, which makes it easier for remote attackers to modify transmitted data via a birthday attack.","status":"published","published":"2015-10-26T17:59:00.107Z","modified":"2026-06-17T00:16:28.373Z","cvss":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:58.385843Z"}],"osv":[{"id":"CVE-2014-8242","description":"librsync before 1.0.0 uses a truncated MD4 checksum to match blocks, which makes it easier for remote attackers to modify transmitted data via a birthday attack.","status":"published","published":"2015-10-26T17:59:00Z","modified":"2026-04-16T06:17:28.5893449Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-8242","description":"librsync before 1.0.0 uses a truncated MD4 checksum to match blocks, which makes it easier for remote attackers to modify transmitted data via a birthday attack.","status":"published","published":"2015-10-26T17:59:00.107Z","modified":"2026-10-23T15:47:39.707098726Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"MGASA-2015-0146","title":"Updated librsync packages fix security vulnerabilities","description":"Updated librsync packages fix security vulnerability:\n\nlibrsync before 1.0.0 used a truncated MD4 \"strong\" check sum to match\nblocks. However, MD4 is not cryptographically strong. It's possible that an\nattacker who can control the contents of one part of a file could use it to\ncontrol other regions of the file, if it's transferred using librsync/rdiff\n(CVE-2014-8242).\n\nThe change to fix this is not backward compatible with older versions of\nlibrsync. Backward compatibility can be obtained using the new `rdiff sig\n--hash=md4` option or through specifying the \"signature magic\" in the API,\nbut this should not be used when either the old or new file contain\nuntrusted data.\n\nAlso, any applications that use the librsync library will need to be\nrecompiled against the updated library.  The duplicity and rdiff-backup\npackages have been rebuilt for this reason.\n","status":"published","published":"2015-04-15T09:01:28Z","modified":"2026-04-16T06:23:25.089482299Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10257-1","title":"librsync-devel-1.0.0-2.8 on GA media","description":"These are all security issues fixed in the librsync-devel-1.0.0-2.8 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:39:52.387021Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10548-1","title":"rsync-3.1.2-1.5 on GA media","description":"These are all security issues fixed in the rsync-3.1.2-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:18:30.984362Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2016:0173-1","title":"Security update for rsync","description":"\nThis update for rsync fixes two security issues and two non-security bugs.\n\nThe following vulnerabilities were fixed:\n\n- CVE-2014-8242: Checksum collisions leading to a denial of service (bsc#900914)\n- CVE-2014-9512: Malicious servers could send files outside of the transferred directory (bsc#915410)\n\nThe following non-security bugs were fixed:\n\n- bsc#922710: Prevent rsyncd from spamming the log when trying to register SLP.\n- bsc#898513: slp support broke rsync usage.\n","status":"published","published":"2016-01-19T19:35:15Z","modified":"2026-02-04T04:27:33.337513Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0176-1","title":"Security update for rsync","description":"\nThis update for rsync fixes two security issues:\n\n- CVE-2014-8242: Checksum collisions leading to a denial of service (bsc#900914)\n- CVE-2014-9512: Malicious servers could send files outside of the transferred directory (bsc#915410)\n","status":"published","published":"2016-01-20T08:59:45Z","modified":"2026-02-04T03:24:51.609156Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"UBUNTU-CVE-2014-8242","description":"librsync before 1.0.0 uses a truncated MD4 checksum to match blocks, which makes it easier for remote attackers to modify transmitted data via a birthday attack.","status":"published","published":"2015-10-26T17:59:00Z","modified":"2026-04-22T09:52:31.339506Z","updated_at":"2026-11-02T15:54:09.378953Z"}]}}