{"id":"CVE-2020-14387","aliases":["ALPINE-CVE-2020-14387","AZL-7462","BELL-CVE-2020-14387","DEBIAN-CVE-2020-14387","EUVD-2020-6527","GHSA-5gm2-c485-9q6q","SUSE-RU-2023:3370-1","openSUSE-SU-2024:11308-1"],"status":"published","title":"A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate...","description":"A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01107,"percentile":0.66276,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-297"],"published":"2021-05-27T19:44:53Z","modified":"2026-10-26T12:02:26Z","fixes":[{"ecosystem":"Alpine:v3.13","package":"rsync","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"rsync","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"rsync","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"rsync","fixed_in":["3.2.3-2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"rsync","fixed_in":["3.2.3-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rsync","fixed_in":["3.2.3-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rsync","fixed_in":["3.2.3-3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.1"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.1"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.1"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-2.6"}]}],"bundled":5}],"products":[{"vendor":"samba","product":"rsync"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1875549","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14387","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5gm2-c485-9q6q"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-14387","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-14387","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-14387","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/-2023-3370/suse-ru-20233370-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1176160","tags":["report"]},{"url":"https://bugzilla.suse.com/1201840","tags":["report"]},{"url":"https://bugzilla.suse.com/1204538","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29154","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-6199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5764","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-14387","description":"A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.","status":"published","published":"2021-05-27T19:44:53Z","modified":"2024-08-04T12:46:33.953Z","cwes":["CWE-297"],"updated_at":"2026-11-02T14:35:46.476719Z"}],"euvd":[{"id":"EUVD-2020-6527","description":"A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.","status":"published","published":"2021-05-27T19:44:53Z","modified":"2024-08-04T12:46:33Z","updated_at":"2026-11-03T03:07:34.099541Z"}],"ghsa":[{"id":"GHSA-5gm2-c485-9q6q","title":"A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate...","description":"A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.","status":"published","published":"2022-05-24T19:03:34Z","modified":"2023-01-29T05:07:47Z","cwes":["CWE-297"],"updated_at":"2026-11-02T14:46:11.123221Z"}],"nvd":[{"id":"CVE-2020-14387","description":"A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.","status":"published","published":"2021-05-27T20:15:07.873Z","modified":"2026-06-17T02:54:40.573Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-297"],"updated_at":"2026-11-02T14:06:43.288951Z"}],"osv":[{"id":"ALPINE-CVE-2020-14387","description":"A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.","status":"published","published":"2021-05-27T20:15:07.873Z","modified":"2026-10-26T11:17:55.125953937Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"AZL-7462","title":"CVE-2020-14387 affecting package rsync for versions less than 3.2.3-2","description":"A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.","status":"published","published":"2021-05-27T20:15:07Z","modified":"2026-04-21T04:38:45.664Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"BELL-CVE-2020-14387","title":"CVE-2020-14387 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:47.737752Z","modified":"2026-01-26T09:46:12.481422Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-14387","description":"A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.","status":"published","published":"2021-05-27T20:15:07.873Z","modified":"2026-10-24T10:30:56.06585244Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"DEBIAN-CVE-2020-14387","description":"A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.","status":"published","published":"2021-05-27T20:15:07.873Z","modified":"2026-10-26T12:02:26.651379319Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"openSUSE-SU-2024:11308-1","title":"rsync-3.2.3-2.6 on GA media","description":"These are all security issues fixed in the rsync-3.2.3-2.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:20:08.288259Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-RU-2023:3370-1","title":"Recommended update for rsync","description":"This update for rsync fixes the following issues:\n\n- Update to version 3.2.3 (jsc#SLE-21252, jsc#PED-3146)\n- Add support for using --atimes to preserve atime of files in destination sync (jsc#PED-3145)\n- Remove SuSEfirewall2 service as this was replaced by firewalld (which already provides a rsyncd service).\n- Fix --delay-updates never updates after interruption (bsc#1204538)\n- Arbitrary file write vulnerability via do_server_recv function (bsc#1201840, CVE-2022-29154)\n- rsync-ssl: Verify the hostname in the certificate when using openssl. (bsc#1176160, CVE-2020-14387)\n\n","status":"published","published":"2023-08-22T09:53:12Z","modified":"2026-02-04T03:07:08.545518Z","updated_at":"2026-11-02T15:53:41.276824Z"}]}}