{"id":"CVE-2017-15994","aliases":["BELL-CVE-2017-15994","EUVD-2017-7410","GHSA-m83x-3x2c-26q8"],"status":"published","title":"rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for...","description":"rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to bypass intended access restrictions. NOTE: the rsync development branch has significant use beyond the rsync developers, e.g., the code has been copied for use in various GitHub projects.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01001,"percentile":0.6306,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-354"],"published":"2017-10-29T06:00:00Z","modified":"2026-10-24T10:30:45Z","products":[{"vendor":"samba","product":"rsync"}],"references":[{"url":"https://git.samba.org/?p=rsync.git%3Ba=commit%3Bh=7b8a4ecd6ff9cdf4e5d3850ebf822f1e989255b3","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://git.samba.org/?p=rsync.git%3Ba=commit%3Bh=c252546ceeb0925eb8a4061315e3ff0a8c55b48b","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://git.samba.org/?p=rsync.git%3Ba=commit%3Bh=9a480deec4d20277d8e20bc55515ef0640ca1e55","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15994"},{"url":"https://git.samba.org/?p=rsync.git;a=commit;h=7b8a4ecd6ff9cdf4e5d3850ebf822f1e989255b3"},{"url":"https://git.samba.org/?p=rsync.git;a=commit;h=9a480deec4d20277d8e20bc55515ef0640ca1e55"},{"url":"https://git.samba.org/?p=rsync.git;a=commit;h=c252546ceeb0925eb8a4061315e3ff0a8c55b48b"},{"url":"https://github.com/advisories/GHSA-m83x-3x2c-26q8"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2017-15994","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-15994","description":"rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to bypass intended access restrictions. NOTE: the rsync development branch has significant use beyond the rsync developers, e.g., the code has been copied for use in various GitHub projects.","status":"published","published":"2017-10-29T06:00:00Z","modified":"2024-08-05T20:13:06.624Z","updated_at":"2026-11-02T14:33:14.271248Z"}],"euvd":[{"id":"EUVD-2017-7410","description":"rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to bypass intended access restrictions. NOTE: the rsync development branch has significant use beyond the rsync developers, e.g., the code has been copied for use in various GitHub projects.","status":"published","published":"2017-10-29T06:00:00Z","modified":"2024-08-05T20:13:06Z","updated_at":"2026-11-03T02:23:12.944585Z"}],"ghsa":[{"id":"GHSA-m83x-3x2c-26q8","title":"rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for...","description":"rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to bypass intended access restrictions. NOTE: the rsync development branch has significant use beyond the rsync developers, e.g., the code has been copied for use in various GitHub projects.","status":"published","published":"2022-05-13T01:44:03Z","modified":"2025-04-20T03:48:52Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-354"],"updated_at":"2026-11-02T15:01:55.184489Z"}],"nvd":[{"id":"CVE-2017-15994","description":"rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to bypass intended access restrictions. NOTE: the rsync development branch has significant use beyond the rsync developers, e.g., the code has been copied for use in various GitHub projects.","status":"published","published":"2017-10-29T06:29:01.107Z","modified":"2026-06-17T01:08:36.927Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-354"],"updated_at":"2026-11-02T14:04:08.01771Z"}],"osv":[{"id":"BELL-CVE-2017-15994","title":"CVE-2017-15994 does not affect BellSoft software","status":"withdrawn","published":"2017-10-29T06:29:00Z","modified":"2026-01-26T09:49:39.038849Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2017-15994","description":"rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to bypass intended access restrictions. NOTE: the rsync development branch has significant use beyond the rsync developers, e.g., the code has been copied for use in various GitHub projects.","status":"published","published":"2017-10-29T06:29:01.107Z","modified":"2026-10-24T10:30:45.80799779Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:04.853379Z"}]}}