{"id":"CVE-2022-29154","aliases":["ALPINE-CVE-2022-29154","ALSA-2022:6180","AZL-10461","BELL-CVE-2022-29154","CLSA-2022-1660756974","CLSA-2022-1660759048","CLSA-2022-1660759162","CLSA-2022-1660761395","CLSA-2022-1660761947","CLSA-2022-1662656989","CLSA-2022-1662657502","CLSA-2022-1662658022","CLSA-2022-1662658118","CLSA-2022-1662658181","CLSA-2022-1662658348","CLSA-2025-1763136711","CLSA-2026-1788335736","CLSA-2026-1788816257","DEBIAN-CVE-2022-29154","EUVD-2022-33562","GHSA-5jgp-wh79-75wg","MGASA-2022-0302","OESA-2022-1875","RHSA-2022:6170","RHSA-2022:6171","RHSA-2022:6172","RHSA-2022:6173","RHSA-2022:6180","RHSA-2022:6181","RHSA-2022:6551","RLSA-2022:6180","RLSA-2022:6181","SUSE-RU-2023:3370-1","SUSE-SU-2022:2825-1","SUSE-SU-2022:2858-1","SUSE-SU-2022:2859-1","SUSE-SU-2022:2959-1","SUSE-SU-2022:2959-2","SUSE-SU-2026:21726-1","UBUNTU-CVE-2022-29154","USN-5921-1","openSUSE-SU-2024:12232-1"],"status":"published","title":"An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write...","description":"An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02348,"percentile":0.83794,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20","CWE-862"],"published":"2022-08-02T14:22:52Z","modified":"2026-11-03T08:04:07Z","exploits":[{"source":"pocgithub","id":"EgeBalci/CVE-2022-29154","title":"EgeBalci/CVE-2022-29154","date":"2022-09-14","url":"https://github.com/EgeBalci/CVE-2022-29154"}],"fixes":[{"ecosystem":"Alpine:v3.13","package":"rsync","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"rsync","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"rsync","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"rsync","fixed_in":["3.2.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"rsync","fixed_in":["3.2.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"rsync","fixed_in":["3.2.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"rsync","fixed_in":["3.2.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"rsync","fixed_in":["3.2.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"rsync","fixed_in":["3.2.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"rsync","fixed_in":["3.2.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"rsync","fixed_in":["3.2.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"rsync","fixed_in":["3.2.4-r2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"rsync","fixed_in":["3.1.3-14.el8_6.3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"rsync-daemon","fixed_in":["3.1.3-14.el8_6.3"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"rsync","fixed_in":["3.2.5-1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"rsync","fixed_in":["3.1.3-12.el8.tuxcare.els2","3.1.3-12.el8.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"rsync-daemon","fixed_in":["3.1.3-12.el8.tuxcare.els2","3.1.3-12.el8.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"rsync","fixed_in":["3.1.3-12.el8.tuxcare.els2","3.1.3-12.el8.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"rsync-daemon","fixed_in":["3.1.3-12.el8.tuxcare.els2","3.1.3-12.el8.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"rsync","fixed_in":["3.0.6-12.el6.tuxcare.els2","3.0.6-12.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"rsync","fixed_in":["3.1.1-3ubuntu1.3+tuxcare.els2","3.1.1-3ubuntu1.3+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"rsync","fixed_in":["3.0.6-12.el6.tuxcare.els2","3.0.6-12.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"rsync","fixed_in":["3.2.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rsync","fixed_in":["3.2.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rsync","fixed_in":["3.2.5-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"rsync","fixed_in":["3.2.2-2.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"rsync","fixed_in":["3.1.3-9.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"rsync","fixed_in":["3.1.3-9.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"rsync","fixed_in":["3.2.3-4.oe2203"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"rsync","fixed_in":["0:3.1.2-11.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"rsync-debuginfo","fixed_in":["0:3.1.2-11.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"rsync","fixed_in":["0:3.1.2-11.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"rsync-debuginfo","fixed_in":["0:3.1.2-11.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"rsync","fixed_in":["0:3.1.2-11.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"rsync-debuginfo","fixed_in":["0:3.1.2-11.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"rsync","fixed_in":["0:3.1.3-12.el8_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"rsync-daemon","fixed_in":["0:3.1.3-12.el8_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"rsync-debuginfo","fixed_in":["0:3.1.3-12.el8_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"rsync-debugsource","fixed_in":["0:3.1.3-12.el8_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"rsync","fixed_in":["0:3.1.3-7.el8_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"rsync-daemon","fixed_in":["0:3.1.3-7.el8_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"rsync-debuginfo","fixed_in":["0:3.1.3-7.el8_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"rsync-debugsource","fixed_in":["0:3.1.3-7.el8_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"rsync","fixed_in":["0:3.1.3-6.el8_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"rsync-daemon","fixed_in":["0:3.1.3-6.el8_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"rsync-debuginfo","fixed_in":["0:3.1.3-6.el8_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"rsync-debugsource","fixed_in":["0:3.1.3-6.el8_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync","fixed_in":["0:3.1.3-14.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-daemon","fixed_in":["0:3.1.3-14.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-debuginfo","fixed_in":["0:3.1.3-14.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-debugsource","fixed_in":["0:3.1.3-14.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rsync-daemon","fixed_in":["0:3.2.3-9.el9_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rsync","fixed_in":["0:3.2.3-9.el9_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rsync-debuginfo","fixed_in":["0:3.2.3-9.el9_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rsync-debugsource","fixed_in":["0:3.2.3-9.el9_0.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"rsync","fixed_in":["0:3.1.3-14.el8_6.3"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"rsync","fixed_in":["0:3.2.3-9.el9_0.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"rsync","fixed_in":["3.2.3-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"rsync","fixed_in":["3.2.3-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"rsync","fixed_in":["3.1.3-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"rsync","fixed_in":["3.1.3-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"rsync","fixed_in":["3.1.0-13.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rsync","fixed_in":["3.1.0-13.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"rsync","fixed_in":["3.1.0-13.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"rsync","fixed_in":["3.1.0-13.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"rsync","fixed_in":["3.1.0-13.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"rsync","fixed_in":["3.1.0-13.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"rsync","fixed_in":["3.1.3-150000.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"rsync","fixed_in":["3.1.3-150000.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"rsync","fixed_in":["3.1.3-150000.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"rsync","fixed_in":["3.1.3-150000.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"rsync","fixed_in":["3.1.3-150000.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"rsync","fixed_in":["3.1.3-150000.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"rsync","fixed_in":["3.1.3-150000.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"rsync","fixed_in":["3.1.3-150000.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"rsync","fixed_in":["3.1.3-150000.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"rsync","fixed_in":["3.1.3-150000.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"rsync","fixed_in":["3.1.3-150000.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"rsync","fixed_in":["3.1.3-150000.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"rsync","fixed_in":["3.1.3-150000.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"rsync","fixed_in":["3.1.3-150000.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"rsync","fixed_in":["3.1.3-150000.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.1","package":"rsync","fixed_in":["3.1.3-150000.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"rsync","fixed_in":["3.1.3-150000.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.1","package":"rsync","fixed_in":["3.1.3-150000.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"rsync","fixed_in":["3.1.3-150000.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"rsync","fixed_in":["3.1.3-150000.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"rsync","fixed_in":["3.1.3-150000.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"rsync","fixed_in":["3.1.3-150000.4.13.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"rsync","fixed_in":["3.1.3-150000.4.13.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.2","package":"rsync","fixed_in":["3.1.3-150000.4.13.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"rsync","fixed_in":["3.1.2-2.1ubuntu1.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"rsync","fixed_in":["3.1.3-8ubuntu0.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rsync","fixed_in":["3.2.7-0ubuntu0.22.04.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rsync","fixed_in":["3.2.4-3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-14.el8_6.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-14.el8_6.3"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-12.el6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3ubuntu1.3+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-12.el6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3ubuntu1.3+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-12.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-12.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-6+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-6+tuxcare.els5"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3ubuntu1.3+tuxcare.els11"}]}],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-2.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-9.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-9.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-4.oe2203"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-11.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"rsync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-11.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-11.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"rsync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-11.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-11.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"rsync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-11.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-12.el8_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-12.el8_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"rsync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-12.el8_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"rsync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-12.el8_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-7.el8_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-7.el8_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"rsync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-7.el8_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"rsync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-7.el8_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-6.el8_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-6.el8_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"rsync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-6.el8_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"rsync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-6.el8_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-14.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-14.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-14.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-14.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-9.el9_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-9.el9_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rsync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-9.el9_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rsync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-9.el9_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_hypervisor:4.4::el8","package":"redhat-virtualization-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.2-202209140405_8.6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_hypervisor:4.4::el8","package":"redhat-virtualization-host-image-update","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.2-202209140405_8.6"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-14.el8_6.3"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-9.el9_0.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-13.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-13.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-13.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-13.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-13.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-13.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150000.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150000.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150000.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150000.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150000.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150000.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150000.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150000.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150000.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150000.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150000.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150000.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150000.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150000.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150000.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150000.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150000.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150000.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150000.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150000.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150000.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150000.4.13.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150000.4.13.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150000.4.13.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.9-4ubuntu1","3.1.0-2","3.1.0-2ubuntu0.1","3.1.0-2ubuntu0.2","3.1.0-2ubuntu0.3","3.1.0-2ubuntu0.4","3.1.0-2ubuntu0.4+esm1","3.1.0-2ubuntu0.4+esm2","3.1.0-2ubuntu0.4+esm3","3.1.0-2ubuntu0.4+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.1-3","3.1.1-3ubuntu1","3.1.1-3ubuntu1.1","3.1.1-3ubuntu1.2","3.1.1-3ubuntu1.3","3.1.1-3ubuntu1.3+esm1","3.1.1-3ubuntu1.3+esm2","3.1.1-3ubuntu1.3+esm3","3.1.1-3ubuntu1.3+esm4","3.1.1-3ubuntu1.3+esm5","3.1.1-3ubuntu1.3+esm6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2.1ubuntu1.6"}]}],"versions":["3.1.2-2","3.1.2-2.1","3.1.2-2.1ubuntu1","3.1.2-2.1ubuntu1.1","3.1.2-2.1ubuntu1.2","3.1.2-2.1ubuntu1.3","3.1.2-2.1ubuntu1.4","3.1.2-2.1ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-8ubuntu0.5"}]}],"versions":["3.1.3-6","3.1.3-8","3.1.3-8ubuntu0.1","3.1.3-8ubuntu0.2","3.1.3-8ubuntu0.3","3.1.3-8ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-0ubuntu0.22.04.2"}]}],"versions":["3.2.3-4ubuntu1","3.2.3-4ubuntu2","3.2.3-8ubuntu1","3.2.3-8ubuntu2","3.2.3-8ubuntu3","3.2.3-8ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2.1ubuntu1.6"}]}],"versions":["3.1.2-2","3.1.2-2.1","3.1.2-2.1ubuntu1","3.1.2-2.1ubuntu1.1","3.1.2-2.1ubuntu1.2","3.1.2-2.1ubuntu1.3","3.1.2-2.1ubuntu1.4","3.1.2-2.1ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-8ubuntu0.5"}]}],"versions":["3.1.3-6","3.1.3-8","3.1.3-8ubuntu0.1","3.1.3-8ubuntu0.2","3.1.3-8ubuntu0.3","3.1.3-8ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-0ubuntu0.22.04.2"}]}],"versions":["3.2.3-4ubuntu1","3.2.3-4ubuntu2","3.2.3-8ubuntu1","3.2.3-8ubuntu2","3.2.3-8ubuntu3","3.2.3-8ubuntu3.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-3.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"samba","product":"rsync"}],"references":[{"url":"https://github.com/WayneD/rsync/tags","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2022/08/02/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Patch","Third Party Advisory","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRQAI7H4M4RQZ2IWZUEEXECBE5D56BH2/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMBOJ77A7T7PQCARMDUK75TE6LLESZ3O/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29154","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRQAI7H4M4RQZ2IWZUEEXECBE5D56BH2/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NMBOJ77A7T7PQCARMDUK75TE6LLESZ3O/"},{"url":"https://github.com/advisories/GHSA-5jgp-wh79-75wg"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-29154","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6180","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-29154","tags":["report"]},{"url":"https://bugzilla.redhat.com/2110928","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-6180.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-29154","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2022-1660756974.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2022-1660759048.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2022-1660759162.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2022-1660761395","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2022-1660761947.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2022-1662656989.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2022-1662657502.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2022-1662658022.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2022-1662658118","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2022-1662658181.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2022-1662658348.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2025-1763136711.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1788335736.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53786","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53789","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53790","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53792","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70452","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70453","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70456","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70458","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70459","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70461","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70462","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70463","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70464","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1788816257.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29154.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-29154","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0302.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30696","tags":["report"]},{"url":"https://seclists.org/oss-sec/2022/q3/77","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2022/08/02/1","tags":["web","article"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OZDMOCCGHF4NPIRQFQC2LBFH6YXI6QMU/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1875","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6170","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2110928","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6170.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29154","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6171","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6171.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6172","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6172.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6173","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6173.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6180.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6181","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6181.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6551","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064604","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2092427","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2099475","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107498","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109393","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109926","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2114849","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6551.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1012","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1012","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1012","tags":["advisory"]},{"url":"https://arxiv.org/abs/2209.12993","tags":["article"]},{"url":"https://datatracker.ietf.org/doc/html/rfc6056#section-3.3.4","tags":["article"]},{"url":"https://lore.kernel.org/lkml/20220428124001.7428-1-w@1wt.eu/","tags":["article"]},{"url":"https://lwn.net/Articles/910435/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-2132","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2132","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2132","tags":["advisory"]},{"url":"https://bugs.dpdk.org/show_bug.cgi?id=1031","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-2526","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2526","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2526","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-2588","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2588","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2588","tags":["advisory"]},{"url":"https://lore.kernel.org/netdev/20220809170518.164662-1-cascardo@canonical.com/T/#u","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32250","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32250","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32250","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/net/netfilter?id=520778042ccca019f3ffa136dd0ca565c486cedd","tags":["article"]},{"url":"https://www.openwall.com/lists/oss-security/2022/05/31/1","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2022:6180","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:6181","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/-2023-3370/suse-ru-20233370-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1176160","tags":["report"]},{"url":"https://bugzilla.suse.com/1201840","tags":["report"]},{"url":"https://bugzilla.suse.com/1204538","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29154","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222825-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222858-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222859-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222959-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222959-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621726-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1202970","tags":["report"]},{"url":"https://bugzilla.suse.com/1234100","tags":["report"]},{"url":"https://bugzilla.suse.com/1234101","tags":["report"]},{"url":"https://bugzilla.suse.com/1234102","tags":["report"]},{"url":"https://bugzilla.suse.com/1234103","tags":["report"]},{"url":"https://bugzilla.suse.com/1234104","tags":["report"]},{"url":"https://bugzilla.suse.com/1235475","tags":["report"]},{"url":"https://bugzilla.suse.com/1254441","tags":["report"]},{"url":"https://bugzilla.suse.com/1262223","tags":["report"]},{"url":"https://bugzilla.suse.com/1264511","tags":["report"]},{"url":"https://bugzilla.suse.com/1264512","tags":["report"]},{"url":"https://bugzilla.suse.com/1264513","tags":["report"]},{"url":"https://bugzilla.suse.com/1264514","tags":["report"]},{"url":"https://bugzilla.suse.com/1264515","tags":["report"]},{"url":"https://bugzilla.suse.com/1265296","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45232","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-29154","tags":["report"]},{"url":"https://download.samba.org/pub/rsync/NEWS","tags":["report"]},{"url":"https://lists.samba.org/archive/rsync/2022-August/032860.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5921-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-29154","description":"An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).","status":"published","published":"2022-08-02T14:22:52Z","modified":"2024-08-03T06:10:59.386Z","updated_at":"2026-11-02T14:34:36.578327Z"}],"euvd":[{"id":"EUVD-2022-33562","description":"An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).","status":"published","published":"2022-08-02T14:22:52Z","modified":"2024-08-03T06:10:59Z","updated_at":"2026-11-03T03:25:39.28463Z"}],"ghsa":[{"id":"GHSA-5jgp-wh79-75wg","title":"An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write...","description":"An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).","status":"published","published":"2022-08-03T00:00:57Z","modified":"2023-01-29T05:01:51Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:44:55.873032Z"}],"nvd":[{"id":"CVE-2022-29154","description":"An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).","status":"published","published":"2022-08-02T15:15:08.52Z","modified":"2026-06-17T04:39:41.807Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:07:24.39467Z"}],"osv":[{"id":"ALPINE-CVE-2022-29154","description":"An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).","status":"published","published":"2022-08-02T15:15:08.52Z","modified":"2026-11-03T07:18:33.153056716Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:51:12.284675Z"},{"id":"AZL-10461","title":"CVE-2022-29154 affecting package rsync for versions less than 3.2.5-1","description":"An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).","status":"published","published":"2022-08-02T15:15:08Z","modified":"2026-04-21T04:20:51.497508Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:00.794214Z"},{"id":"BELL-CVE-2022-29154","title":"CVE-2022-29154 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:54.396053Z","modified":"2026-01-26T09:49:05.028678Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"DEBIAN-CVE-2022-29154","description":"An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).","status":"published","published":"2022-08-02T15:15:08.52Z","modified":"2026-11-03T08:04:07.961135227Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T08:23:07.763774Z"},{"id":"OESA-2022-1875","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer.It uses the \"rsync algorithm\" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).(CVE-2022-29154)","status":"published","published":"2022-09-01T11:05:09Z","modified":"2026-08-18T01:17:17.054703799Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2022:6170","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2024-09-16T08:39:57Z","modified":"2026-06-26T11:00:15Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:6171","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2024-09-16T08:39:44Z","modified":"2025-12-27T10:32:48.548728Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:6172","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2024-09-16T08:40:38Z","modified":"2025-12-27T10:32:02.609843Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:6173","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2024-09-16T08:39:50Z","modified":"2025-12-27T10:32:03.887208Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:6180","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2024-09-16T08:40:23Z","modified":"2025-12-27T10:32:49.817242Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:6181","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2024-09-16T08:40:15Z","modified":"2026-06-26T12:22:29.493138234Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:6551","title":"Red Hat Security Advisory: Red Hat Virtualization security update","status":"published","published":"2024-09-16T08:39:48Z","modified":"2026-10-15T10:03:06Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RLSA-2022:6180","title":"Important: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: remote arbitrary files write inside the directories of connecting peers (CVE-2022-29154)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-08-24T17:04:49Z","modified":"2026-02-04T09:00:07.814532Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2022:6181","title":"Important: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: remote arbitrary files write inside the directories of connecting peers (CVE-2022-29154)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-08-24T17:06:01Z","modified":"2026-02-05T00:15:11.302224Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-29154","description":"An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).","status":"published","published":"2022-08-02T15:15:00Z","modified":"2026-06-16T13:30:32.038751327Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"ALSA-2022:6180","title":"Important: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\nSecurity Fix(es):\n* rsync: remote arbitrary files write inside the directories of connecting peers (CVE-2022-29154)\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-08-24T00:00:00Z","modified":"2026-10-29T11:01:20.174531194Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"CLSA-2022-1660756974","title":"Fixed CVE-2022-29154 in rsync","description":"- CVE-2022-29154: fix arbitrary file write vulnerability via malicious rysnc server (MITM attack)","status":"published","published":"2022-08-17T17:22:54Z","modified":"2026-06-01T00:33:19.311401674Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1660759048","title":"Fixed CVE-2022-29154 in rsync","description":"- CVE-2022-29154: fix arbitrary file write vulnerability via malicious rysnc server (MITM attack)","status":"published","published":"2022-08-17T17:57:28Z","modified":"2026-06-01T00:32:38.986736503Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1660759162","title":"Fixed CVE-2022-29154 in rsync","description":"- CVE-2022-29154: fix arbitrary file write vulnerability via malicious rysnc\n  server (MITM attack)\n- Add '%check\nunset DISPLAY\n' section but disable broken 'daemon' and 'hardlinks' tests","status":"published","published":"2022-08-17T17:59:22Z","modified":"2026-06-01T00:33:24.529009841Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1660761395","title":"Fix CVE(s): CVE-2022-29154","description":"\n   * SECURITY UPDATE: arbitrary file write vulnerability via malicious\n     rysnc server (MITM attack)\n     - debian/patches/CVE-2022-29154.patch: add extra file-list safety\n       checks.\n     - CVE-2022-29154\n   * Fix noatime patch to build the testsuite and enable it in debian/rules","status":"published","published":"2022-08-17T18:36:35Z","modified":"2026-06-04T10:04:27.518648Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1660761947","title":"Fixed CVE-2022-29154 in rsync","description":"- CVE-2022-29154: fix arbitrary file write vulnerability via malicious rysnc\n  server (MITM attack)\n- Add '%check\nunset DISPLAY\n' section but disable broken 'daemon' and 'hardlinks' tests","status":"published","published":"2022-08-17T18:45:47Z","modified":"2026-06-01T00:33:15.724688627Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1662656989","title":"Fixed CVE-2022-29154 in rsync","description":"- CVE-2022-29154: refactoring due to broken command line arguments parsing","status":"published","published":"2022-09-08T17:09:49Z","modified":"2026-06-01T00:33:20.299221028Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1662657502","title":"Fixed CVE-2022-29154 in rsync","description":"- CVE-2022-29154: refactoring due to broken command line arguments parsing","status":"published","published":"2022-09-08T17:18:22Z","modified":"2026-06-01T00:33:20.365243026Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1662658022","title":"Fixed CVE-2022-29154 in rsync","description":"- CVE-2022-29154: refactoring due to broken command line arguments parsing","status":"published","published":"2022-09-08T17:27:02Z","modified":"2026-06-01T00:32:38.981976347Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1662658118","title":"Fix CVE(s): CVE-2022-29154","description":"\n   * SECURITY UPDATE: arbitrary file write vulnerability via malicious\n     rsync server (MITM attack), refactoring\n     - debian/patches/CVE-2022-29154-0.patch: prepare for CVE-2022-29154\n       patch\n     - debian/patches/CVE-2022-29154-1.patch: add extra file-list safety\n       checks\n     - CVE-2022-29154","status":"published","published":"2022-09-08T17:28:38Z","modified":"2026-06-04T10:03:29.275642Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1662658181","title":"Fixed CVE-2022-29154 in rsync","description":"- CVE-2022-29154: fix arbitrary file write vulnerability via malicious rsync\n  server (MITM attack), refactoring\n- fix test-system components, enable 'daemon' and 'hardlinks' tests","status":"published","published":"2022-09-08T17:29:41Z","modified":"2026-06-01T00:32:32.777773755Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1662658348","title":"Fixed CVE-2022-29154 in rsync","description":"- CVE-2022-29154: fix arbitrary file write vulnerability via malicious rsync\n  server (MITM attack), refactoring\n- fix test-system components, enable 'daemon' and 'hardlinks' tests","status":"published","published":"2022-09-08T17:32:28Z","modified":"2026-06-01T00:33:15.827864693Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2025-1763136711","title":"Fix CVE(s): CVE-2022-29154, CVE-2024-12087, CVE-2024-12088","description":"   * SECURITY UPDATE: malicious remote servers to write arbitrary files inside\n     the directories of connecting peers:\n     - debian/patches/els/0001-CVE-2022-29154.patch: fix insufficient validation of file\n       names.\n     - CVE-2022-29154.\n   * SECURITY UPDATE: path traversal vulnerability.\n     - debian/patches/els/0002-CVE-2024-12087.patch: refuse a duplicate dirlist and\n       range check dir_ndx before use\n     - CVE-2024-12087\n   * SECURITY UPDATE: rsync client fails to properly verify if a symbolic link\n     destination sent from the server contains another symbolic link within it:\n     - debian/patches/els/0003-CVE-2024-12088.patch: make --safe-links stricter.\n     - CVE-2024-12088.","status":"published","published":"2025-11-14T16:11:55Z","modified":"2026-06-04T10:03:20.343087Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2026-1788335736","title":"Fix of 13 CVEs","description":"   * SECURITY UPDATE: peer-driven one-byte heap out-of-bounds write in\n     add_implied_include() from a files-from entry carrying both an interior\n     and a trailing backslash:\n     - debian/patches/els/0009-CVE-2026-70461.patch: count a trailing\n       backslash when sizing the appended-wildcard pattern.\n     - CVE-2026-70461.\n   * SECURITY UPDATE: heap out-of-bounds write in read_args() when the peer's\n     argument count lands exactly on the argv allocation:\n     - debian/patches/els/0010-CVE-2026-70456.patch: reserve room for the\n       trailing NULL terminator.\n     - CVE-2026-70456.\n   * SECURITY UPDATE: out-of-bounds write from a file entry marked\n     FLAG_HLINKED that the receiver accepted with hard-link preservation\n     inactive:\n     - debian/patches/els/0011-CVE-2026-70458.patch: gate FLAG_HLINKED on\n       preserve_hard_links and exclude directories.\n     - CVE-2026-70458.\n   * SECURITY UPDATE: sender-side out-of-bounds read driven by a malicious\n     receiver's checksum header with a non-zero block count and a zero block\n     length:\n     - debian/patches/els/0012-CVE-2026-53792.patch: reject a zero block\n       length in read_sum_head().\n     - CVE-2026-53792.\n   * SECURITY UPDATE: CPU exhaustion in the sending process via\n     quadratic-time behaviour in hash_search(), driven by a malicious\n     receiver's crafted equal-weak-checksum block list. The attacker is the\n     receiver, but the cycles burned are the sender's: hash_search() is\n     reached only through match_sums(), whose sole caller is send_files() in\n     sender.c. NVD's text attributes the CPU to the receiver; the direction\n     stated here is what the code does:\n     - debian/patches/els/0013-CVE-2026-70453.patch: bound the per-offset\n       chain walk.\n     - CVE-2026-70453.\n   * SECURITY UPDATE: daemon \"hosts deny\" failing open when a configured\n     hostname token cannot be resolved:\n     - debian/patches/els/0014-CVE-2026-70452.patch: treat an unresolvable\n       deny-list token as a match.\n     - CVE-2026-70452.\n   * SECURITY UPDATE: daemon \"auth users\" ignoring its documented comma-only\n     parsing, silently discarding a deny rule that names a group whose name\n     contains a space:\n     - debian/patches/els/0015-CVE-2026-70463.patch: parse the list with\n       conf_strtok().\n     - CVE-2026-70463.\n   * SECURITY UPDATE: peer-supplied MSG_IO_TIMEOUT disabling the client's own\n     I/O timeout through a non-positive or overflowing value:\n     - debian/patches/els/0016-CVE-2026-70462.patch: cap the received value\n       and make set_io_timeout() arithmetic overflow-safe.\n     - CVE-2026-70462.\n   * SECURITY UPDATE: client-supplied --filter merge file bypassing the daemon\n     module filter list:\n     - debian/patches/els/0017-CVE-2026-53786.patch: strip the module-dir\n       prefix before the daemon-filter check.\n     - CVE-2026-53786.\n   * SECURITY UPDATE: per-connection daemon child crash on a crafted first\n     incremental file list whose transfer root is a non-directory dot entry:\n     - debian/patches/els/0018-CVE-2026-70459.patch: reject a non-directory\n       transfer-root entry and require a dir_flist entry before trusting\n       parent_ndx 0.\n     - CVE-2026-70459.\n   * SECURITY UPDATE: malicious sender widening the receiver's --delete scope\n     beyond the destination subtree via implied-parent reclassification:\n     - debian/patches/els/0019-CVE-2026-53789.patch: force implied-parent\n       directories non-content on the receiver, including the synthetic\n       transfer root and the pre-protocol-30 encoding.\n     - CVE-2026-53789.\n   * SECURITY UPDATE: unauthenticated pre-transfer handshake stall holding a\n     per-connection daemon child past the module's max connections limit:\n     - debian/patches/els/0020-CVE-2026-70464.patch: bound every\n       peer-controlled handshake read with an absolute deadline and cap the\n       early-protocol argument count.\n     - CVE-2026-70464.\n   * SECURITY UPDATE: command and argument injection through the\n     RSYNC_CONNECT_PROG %H host substitution, through unquoted arguments in a\n     --write-batch replay script, and through remote-shell argument quoting\n     that did not escape the newline, the carriage return or the backtick:\n     - debian/patches/els/0021-CVE-2026-53790.patch: shell-quote and validate\n       the connect host, and quote every replay-script argument.\n     - debian/patches/els/0025-CVE-2026-53790-safe-arg-shell-chars.patch: add\n       the newline, the carriage return and the backtick to safe_arg()'s\n       SHELL_CHARS escape set. safe_arg() escapes metacharacters because the\n       remote end is reached as \"ssh \u003chost\u003e rsync --server ...\", where ssh\n       joins the command words and the remote sshd hands the string to the\n       remote user's login shell, which re-parses it; an unescaped newline\n       therefore ended the transfer command and ran what followed, and an\n       unescaped backtick opened a command substitution. This package\n       acquired safe_arg() from els/0001-CVE-2022-29154.patch, whose donor\n       predates the backtick's addition upstream.\n     - Partial fix: the daemon %RSYNC_*% exec-hook expansions do not exist in\n       3.1.3 and rsync-ssl is not installed by debian/rules, so those two of\n       the four sinks named in the advisory are not present in this package.\n     - CVE-2026-53790.\n   * SECURITY UPDATE: further out-of-bounds F_SUM() reads where the checksum\n     extra slot was never reserved -- a daemon sender with \"%C\" in its log\n     format, a hard-linked non-regular entry compared against a basis dir,\n     and \"%C\" on a deletion:\n     - debian/patches/els/0022-CVE-2026-70458.patch: set\n       sender_keeps_checksum in start_server(), require S_ISREG(file-\u003emode)\n       before the content compare in hard_link_check(), and skip the\n       checksum for an ITEM_DELETED entry.\n     - CVE-2026-70458.\n   * Drop two peer-reachable assert() aborts (no CVE assigned; carried from\n     the same upstream commit as several of the fixes above, and live in the\n     shipped binary because nothing in the build defines NDEBUG):\n     - debian/patches/els/0023-peer-reachable-asserts.patch: turn an\n       undeclared cross-flist hard-link gnum into a protocol error instead of\n       an assert, and stop asserting !is_utf8 when a daemon receiver\n       forwards a peer message to the generator.\n   * Bound merge-file include recursion (no CVE assigned; the remaining\n     peer-reachable crash hunk of the same upstream commit several of the\n     fixes above come from). A merge file's content may name another merge\n     file, so parse_filter_file() re-enters itself with a BIGPATHBUFLEN\n     stack buffer per level; a self-referencing per-directory merge file,\n     whose content the peer supplies through the transferred tree, recursed\n     until the stack was exhausted (SIGSEGV):\n     - debian/patches/els/0024-merge-file-depth-cap.patch: add\n       MAX_MERGE_DEPTH and a nesting counter.\n   * Add committed regression tests to the shipped test suite for the six\n     fixes that a black-box test can observe, each carried by the patch it\n     proves and each failing without that patch:\n     - testsuite/cve-2026-70452.test (els/0014), an unresolvable \"hosts deny\"\n       token must deny.\n     - testsuite/cve-2026-70463.test (els/0015), the first word of a\n       space-bearing \"auth users\" entry must not become an allow rule.\n     - testsuite/cve-2026-53786.test (els/0017), a daemon filter rule must\n       govern a client merge file, and an \"exclude from\" path that only shares\n       the module path's textual prefix must not be truncated.\n     - testsuite/cve-2026-53790.test (els/0021), a newline-bearing filter rule\n       must not reach the replay script and an injected RSYNC_CONNECT_PROG %H\n       host must not execute.\n     - testsuite/cve-2026-53790-shell-chars.test (els/0025), a newline, a\n       carriage return or a backtick in a path must not execute a command on\n       the remote shell, and an ordinary transfer over the same remote shell\n       must still work.\n     - testsuite/cve-2026-70458.test (els/0022), the daemon's logged \"%C\" must\n       be the file's checksum, not adjacent pool memory.\n     - testsuite/merge-depth.test (els/0024), a self-referencing merge file\n       must be refused, not crash the process.\n     - testsuite/cve-2026-53790-safe-arg-uninit.test (els/0027), a trailing\n       backslash in a path must reach the remote shell doubled, and no stray\n       byte may follow a path that carries a backslash.\n   * SECURITY UPDATE: safe_arg() sized its result one byte larger than it\n     wrote for every backslash that precedes a wildcard and for a trailing\n     backslash, so the closing NUL landed past the last byte written and\n     uninitialised heap was returned inside the string handed to the remote\n     shell (--protect-args is off by default in 3.1.3). The same defect left a\n     trailing backslash unescaped there, where it escapes the following space\n     and joins the next word:\n     - debian/patches/els/0027-CVE-2026-53790-safe-arg-uninit.patch: make the\n       escape counter mirror the writer and guard the WILD_CHARS lookup with\n       f[1]. Upstream's own stable-branch backport (1aef79e1 on\n       v3.2.7-sec-patches3, from 22efd249), applied unchanged.\n     - CVE-2026-53790.\n   * SECURITY UPDATE: a fourth out-of-bounds F_SUM() read, specific to this\n     package. generator.c unchanged_file() guards the checksum compare on the\n     destination's on-disk mode while the slot is reserved from the\n     peer-supplied file-\u003emode; Debian's copy-devices.diff lets a device entry\n     reach it, so with -c --copy-devices a sender's device entry whose\n     destination is an existing regular file reads below its pool slot:\n     - debian/patches/els/0030-CVE-2026-70458-copy-devices.patch: require\n       S_ISREG(file-\u003emode) as well.\n     - CVE-2026-70458.\n   * Carry the four remaining hunks of upstream 3eeedf8d that land in\n     functions this series already patches (no CVE assigned; the same\n     malicious-peer hardening commit seven of the patches above cite):\n     - debian/patches/els/0026-donor-parity-3eeedf8d.patch: re-check the block\n       length before adopting want_i in hash_search(), clamp a peer-supplied\n       s-\u003eflength to the local length in match_sums(), and refuse a sub-flist\n       that arrives after the final flist was freed or that names a cleared\n       dir_flist slot in recv_file_list().\n   * Fix secure_relative_open() never returning a directory descriptor. The\n     per-component walk only assigned the result in its ENOTDIR arm, so a\n     path that resolved to a directory fell through to \"errno = EINVAL\" and\n     returned -1. Every permission change on a daemon receiver running with\n     \"use chroot = no\" therefore failed with \"failed to set permissions ...\n     Invalid argument (22)\" and the transfer exited 23. Introduced by\n     els/0006-CVE-2026-29518.patch, which added both the helper and its\n     O_DIRECTORY callers:\n     - debian/patches/els/0029-secure-relative-open-dirfd.patch.\n   * Run the upstream testsuite during the build, so the regression tests\n     above are load-bearing:\n     - debian/patches/els/0028-testsuite-harness.patch: add the missing\n       syscall.o stubs (noatime, am_daemon, am_chrooted) to tls.c,\n       trimslash.c and t_unsafe.c, without which \"make check\" could not even\n       link its helper programs, and let runtests.sh honour a $skiptests list.\n     - debian/rules: run \"make check\" from build-stamp unless\n       DEB_BUILD_OPTIONS=nocheck, excluding devices and devices-fake, which\n       fail identically on 3.1.3 with only the Debian patches applied.","status":"published","published":"2026-09-02T07:58:24Z","modified":"2026-10-26T09:43:29.311029583Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788816257","title":"Fix CVE(s): CVE-2026-53786, CVE-2026-53789, CVE-2026-70459, CVE-2026-70463","description":"   * SECURITY UPDATE: \"auth users\" authorization bypass on entries containing\n     a space\n     - debian/patches/CVE-2026-70463.patch: parse the \"auth users\" value with\n       conf_strtok() in auth_server(), so the documented leading-comma form\n       splits on commas alone and an \"@Group Name:deny\" entry is no longer\n       torn in two -- discarding the deny rule and creating an implicit allow\n       rule from its first word; import conf_strtok() into util.c, which this\n       version does not yet carry; document the leading-comma form in\n       rsyncd.conf.yo and in the pre-generated rsyncd.conf.5 (this tree ships\n       no yodl2man, so only the .5 is installed), without which an admin is\n       never told the form that activates the fix; and add\n       testsuite/cve-2026-70463.test\n     - CVE-2026-70463\n   * SECURITY UPDATE: daemon filter-merge bypass of the module filter list\n     - debian/patches/CVE-2026-53786.patch: in parse_filter_file(), strip the\n       module_dir prefix that parse_merge_name() prepended before checking a\n       client-supplied --filter merge file against daemon_filter_list, so the\n       anchored module-relative daemon rule can match; the strip is\n       conditional on the prefix really being present so the daemon's own\n       \"include from\" / \"exclude from\" and get_cvs_excludes() paths are not\n       truncated; upstream's early return on a daemon-filter hit is\n       deliberately not taken, since without v3.5.0's\n       daemon_config_filter_file exemption it would silently drop the\n       operator's own \"include from\" / \"exclude from\" rules and, without\n       v3.5.0's name+errno suppression, would leave hidden merge files\n       silent while missing ones stay fatal; add\n       testsuite/cve-2026-53786.test\n     - CVE-2026-53786\n   * SECURITY UPDATE: daemon NULL dereference on a non-directory first\n     file-list entry\n     - debian/patches/CVE-2026-70459.patch: reject a \".\" or \"/.\" transfer-root\n       entry whose mode is not a directory in recv_file_entry(), and require\n       dir_flist to actually hold an entry in recv_file_list() before trusting\n       parent_ndx 0, closing the wild-pointer read that crashes the\n       per-connection daemon child\n     - CVE-2026-70459\n   * SECURITY UPDATE: --delete scope widening via implied-parent\n     reclassification\n     - debian/patches/CVE-2026-53789.patch: add is_implied_parent_dir() to\n       exclude.c and use it in recv_file_entry() to force an implied parent\n       back to the honest XMIT_TOP_DIR | XMIT_NO_CONTENT_DIR encoding, on both\n       the protocol \u003e= 30 and the legacy protocol \u003c 30 paths, so it lands in\n       FLAG_IMPLIED_DIR and delete_in_dir() cannot sweep pre-existing siblings\n       outside the intended destination subtree\n     - debian/patches/CVE-2022-29154-2.patch: drop the trailing slash in\n       add_implied_include(), completing the upstream CVE-2022-29154 series\n       this branch carries, so a \"src/dir/\" argument seeds the requested leaf\n       as a plain include rule instead of a FILTRULE_DIRECTORY one; without it\n       is_implied_parent_dir() would classify the explicitly requested\n       directory as an implied parent and --delete would stop pruning it\n     - CVE-2026-53789","status":"published","published":"2026-09-07T21:24:31Z","modified":"2026-10-26T09:43:35.249028467Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CVE-2022-29154","description":"An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).","status":"published","published":"2022-08-02T14:22:52Z","modified":"2026-10-28T10:28:14.399414309Z","updated_at":"2026-11-02T15:44:25.164673Z"},{"id":"MGASA-2022-0302","title":"Updated rsync packages fix security vulnerability","description":"An issue was discovered in rsync before 3.2.5 that allows malicious remote\nservers to write arbitrary files inside the directories of connecting\npeers. The server chooses which files/directories are sent to the client.\nHowever, the rsync client performs insufficient validation of file names.\nA malicious rsync server (or Man-in-The-Middle attacker) can overwrite\narbitrary files in the rsync client target directory and subdirectories\n(for example, overwrite the .ssh/authorized_keys file). (CVE-2022-29154)\n","status":"published","published":"2022-08-25T21:21:07Z","modified":"2026-04-16T04:44:11.232588145Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12232-1","title":"rsync-3.2.4-3.1 on GA media","description":"These are all security issues fixed in the rsync-3.2.4-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:42:38.639915Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-RU-2023:3370-1","title":"Recommended update for rsync","description":"This update for rsync fixes the following issues:\n\n- Update to version 3.2.3 (jsc#SLE-21252, jsc#PED-3146)\n- Add support for using --atimes to preserve atime of files in destination sync (jsc#PED-3145)\n- Remove SuSEfirewall2 service as this was replaced by firewalld (which already provides a rsyncd service).\n- Fix --delay-updates never updates after interruption (bsc#1204538)\n- Arbitrary file write vulnerability via do_server_recv function (bsc#1201840, CVE-2022-29154)\n- rsync-ssl: Verify the hostname in the certificate when using openssl. (bsc#1176160, CVE-2020-14387)\n\n","status":"published","published":"2023-08-22T09:53:12Z","modified":"2026-02-04T03:07:08.545518Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2022:2825-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2022-29154: Fixed an arbitrary file write when connecting to a\n  malicious server (bsc#1201840).\n","status":"published","published":"2022-08-16T15:12:55Z","modified":"2026-02-04T02:19:30.807536Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:2858-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2022-29154: Fixed an arbitrary file write issue that could be\n  triggered by a malicious remote server (bsc#1201840).\n","status":"published","published":"2022-08-19T14:12:17Z","modified":"2026-02-04T03:36:24.471621Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:2859-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2022-29154: Fixed an arbitrary file write issue that could be\n  triggered by a malicious remote server (bsc#1201840).\n","status":"published","published":"2022-08-19T14:12:56Z","modified":"2026-02-04T03:21:11.052037Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:2959-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2022-29154: Fixed an arbitrary file write issue that could be\n  triggered by a malicious remote server (bsc#1201840).\n","status":"published","published":"2022-08-31T11:10:23Z","modified":"2026-02-04T02:30:32.602632Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:2959-2","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2022-29154: Fixed an arbitrary file write issue that could be\n  triggered by a malicious remote server (bsc#1201840).\n","status":"published","published":"2022-08-31T11:10:34Z","modified":"2026-02-04T03:17:30.237578Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2026:21726-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\nSecurity issues:\n\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n\nNon security issues:\n\n- rsync --delay-updates never updates after interruption (bsc#1204538).\n- Fix duplication of flag causing illegal hashkey failures.\n","status":"published","published":"2026-05-21T11:04:19Z","modified":"2026-05-23T18:23:40.42363199Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"USN-5921-1","title":"rsync vulnerabilities","description":"Koen van Hove discovered that the rsync client incorrectly validated\nfilenames returned by servers. If a user or automated system were tricked\ninto connecting to a malicious server, a remote attacker could use this\nissue to write arbitrary files, and possibly escalate privileges.\n","status":"published","published":"2023-03-06T12:11:44Z","modified":"2026-02-10T04:43:00Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}