{"id":"CVE-2024-12747","aliases":["ALPINE-CVE-2024-12747","ALSA-2025:2600","ALSA-2025:7050","AZL-55673","AZL-55679","BELL-CVE-2024-12747","CLSA-2025-1737990875","CLSA-2025-1737990907","CLSA-2025-1738170434","CLSA-2025-1738265246","CLSA-2025-1739386458","CLSA-2025-1739388237","CLSA-2025-1740131776","CLSA-2025-1751142056","CLSA-2026-1778236507","DEBIAN-CVE-2024-12747","DLA-4015-1","DSA-5843-1","EUVD-2024-51084","GHSA-gp7r-m4cc-qhwq","MGASA-2025-0019","OESA-2025-1060","OESA-2025-1061","OESA-2025-1062","OESA-2025-1063","OESA-2025-1064","RHBA-2025:6470","RHSA-2025:2600","RHSA-2025:7050","RLSA-2025:2600","RLSA-2025:7050","SUSE-SU-2025:0156-1","SUSE-SU-2025:0157-1","SUSE-SU-2025:0165-1","SUSE-SU-2025:0166-1","SUSE-SU-2025:0991-1","SUSE-SU-2025:20122-1","SUSE-SU-2025:20223-1","SUSE-SU-2026:2038-1","SUSE-SU-2026:2048-1","SUSE-SU-2026:2083-1","SUSE-SU-2026:21726-1","UBUNTU-CVE-2024-12747","USN-7206-1","openSUSE-SU-2025:14665-1"],"status":"published","title":"Rsync: race condition in rsync handling symbolic links","description":"A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.","severity":{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00385,"percentile":0.33002,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2025-01-09T00:00:00Z","modified":"2026-11-05T21:16:03Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"rsync","fixed_in":["3.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"rsync","fixed_in":["3.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"rsync","fixed_in":["3.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"rsync","fixed_in":["3.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"rsync","fixed_in":["3.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"rsync","fixed_in":["3.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"rsync","fixed_in":["3.4.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"rsync","fixed_in":["3.4.1-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"rsync","fixed_in":["3.4.1-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"rsync","fixed_in":["3.2.7-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"rsync","fixed_in":["3.4.1-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"rsync","fixed_in":["3.1.1-3ubuntu1.3+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"rsync","fixed_in":["3.1.3-19.el8.1.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"rsync-daemon","fixed_in":["3.1.3-19.el8.1.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"rsync","fixed_in":["3.1.2-12.el7_9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"rsync","fixed_in":["3.1.2-12.el7_9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"rsync","fixed_in":["3.1.2-2.1ubuntu1.6+tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"rsync","fixed_in":["3.1.2-12.el7_9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"rsync","fixed_in":["3.2.7-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rsync","fixed_in":["3.3.0+ds1-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rsync","fixed_in":["3.3.0+ds1-3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"rsync","fixed_in":["3.2.3-150000.4.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"rsync","fixed_in":["3.2.3-150000.4.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"rsync","fixed_in":["3.2.3-150000.4.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"rsync","fixed_in":["3.2.3-150000.4.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"rsync","fixed_in":["3.2.3-150000.4.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"rsync","fixed_in":["3.2.3-150000.4.36.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"rsync","fixed_in":["3.1.0-2ubuntu0.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rsync","fixed_in":["3.1.1-3ubuntu1.3+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rsync","fixed_in":["3.1.2-2.1ubuntu1.6+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"rsync","fixed_in":["3.1.3-8ubuntu0.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rsync","fixed_in":["3.2.7-0ubuntu0.22.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rsync","fixed_in":["3.2.7-1ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-21.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-21.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-3.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-3.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-3.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Azure Linux:2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.7-r0"},{"fixed":"3.2.7-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.5-r0"},{"fixed":"3.4.1-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8.tuxcare.els6"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8.tuxcare.els6"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8.tuxcare.els6"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8.tuxcare.els6"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3ubuntu1.3+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-19.el8.1.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-19.el8.1.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-12.el7_9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-12.el7_9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2.1ubuntu1.6+tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-12.el7_9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-19.el9.tuxcare.els4"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-19.el9.tuxcare.els4"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1+deb12u1"}]}],"versions":["3.2.7-1"]},{"source":"osv","ecosystem":"Debian:13","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0+ds1-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0+ds1-3"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-4+deb11u2"}]}],"versions":["3.2.3-4","3.2.3-4+deb11u1"],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1+deb12u1"}]}],"versions":["3.2.7-1"],"bundled":6},{"source":"osv","ecosystem":"Mageia:9","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1.2.mga9"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-4.oe2203sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-6.oe2403sp1"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-4.oe2203sp3"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-11.oe2003sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-6.oe2403"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-2.el10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-2.el10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-2.el10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rsync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-2.el10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rsync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-2.el10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-21.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-21.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-21.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-21.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-3.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-3.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-3.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rsync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-3.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rsync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-3.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-21.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-3.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-150600.3.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-150600.3.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.33.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.33.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.33.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.33.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.33.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.33.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-3.22.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-3.22.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-4.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-slfo.1.1_3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-2ubuntu0.4+esm1"}]}],"versions":["3.0.9-4ubuntu1","3.1.0-2","3.1.0-2ubuntu0.1","3.1.0-2ubuntu0.2","3.1.0-2ubuntu0.3","3.1.0-2ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3ubuntu1.3+esm3"}]}],"versions":["3.1.1-3","3.1.1-3ubuntu1","3.1.1-3ubuntu1.1","3.1.1-3ubuntu1.2","3.1.1-3ubuntu1.3","3.1.1-3ubuntu1.3+esm1","3.1.1-3ubuntu1.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2.1ubuntu1.6+esm1"}]}],"versions":["3.1.2-2","3.1.2-2.1","3.1.2-2.1ubuntu1","3.1.2-2.1ubuntu1.1","3.1.2-2.1ubuntu1.2","3.1.2-2.1ubuntu1.3","3.1.2-2.1ubuntu1.4","3.1.2-2.1ubuntu1.5","3.1.2-2.1ubuntu1.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-8ubuntu0.8"}]}],"versions":["3.1.3-6","3.1.3-8","3.1.3-8ubuntu0.1","3.1.3-8ubuntu0.2","3.1.3-8ubuntu0.3","3.1.3-8ubuntu0.4","3.1.3-8ubuntu0.5","3.1.3-8ubuntu0.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-0ubuntu0.22.04.3"}]}],"versions":["3.2.3-4ubuntu1","3.2.3-4ubuntu2","3.2.3-8ubuntu1","3.2.3-8ubuntu2","3.2.3-8ubuntu3","3.2.3-8ubuntu3.1","3.2.7-0ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1ubuntu1.1"}]}],"versions":["3.2.7-1","3.2.7-1build1","3.2.7-1build2","3.2.7-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-2ubuntu0.4+esm1"}]}],"versions":["3.0.9-4ubuntu1","3.1.0-2","3.1.0-2ubuntu0.1","3.1.0-2ubuntu0.2","3.1.0-2ubuntu0.3","3.1.0-2ubuntu0.4"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3ubuntu1.3+esm3"}]}],"versions":["3.1.1-3","3.1.1-3ubuntu1","3.1.1-3ubuntu1.1","3.1.1-3ubuntu1.2","3.1.1-3ubuntu1.3","3.1.1-3ubuntu1.3+esm1","3.1.1-3ubuntu1.3+esm2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2.1ubuntu1.6+esm1"}]}],"versions":["3.1.2-2","3.1.2-2.1","3.1.2-2.1ubuntu1","3.1.2-2.1ubuntu1.1","3.1.2-2.1ubuntu1.2","3.1.2-2.1ubuntu1.3","3.1.2-2.1ubuntu1.4","3.1.2-2.1ubuntu1.5","3.1.2-2.1ubuntu1.6"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-8ubuntu0.8"}]}],"versions":["3.1.3-6","3.1.3-8","3.1.3-8ubuntu0.1","3.1.3-8ubuntu0.2","3.1.3-8ubuntu0.3","3.1.3-8ubuntu0.4","3.1.3-8ubuntu0.5","3.1.3-8ubuntu0.7"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-0ubuntu0.22.04.3"}]}],"versions":["3.2.3-4ubuntu1","3.2.3-4ubuntu2","3.2.3-8ubuntu1","3.2.3-8ubuntu2","3.2.3-8ubuntu3","3.2.3-8ubuntu3.1","3.2.7-0ubuntu0.22.04.2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1ubuntu1.1"}]}],"versions":["3.2.7-1","3.2.7-1build1","3.2.7-1build2","3.2.7-1ubuntu1"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-1.1"}]}],"bundled":6}],"products":[{"vendor":"red hat","product":"red hat discovery 1.14"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift container platform 4"}],"references":[{"url":"https://access.redhat.com/errata/RHBA-2025:6470","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:2600","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7050","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8385","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-12747","tags":["vdb-entry","x_refsource_REDHAT","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2332968","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://kb.cert.org/vuls/id/952657","tags":["web","article"]},{"url":"https://security.netapp.com/advisory/ntap-20250131-0002/","tags":["advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00008.html","tags":["web"]},{"url":"https://www.kb.cert.org/vuls/id/952657","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12747","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20250131-0002"},{"url":"https://github.com/advisories/GHSA-gp7r-m4cc-qhwq"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-12747","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-12087","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-12088","tags":["report"]},{"url":"https://bugzilla.redhat.com/2330672","tags":["report"]},{"url":"https://bugzilla.redhat.com/2330676","tags":["report"]},{"url":"https://bugzilla.redhat.com/2332968","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-2600.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-7050.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-12747","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2025-1737990875.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2025-1737990907.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16-els/CLSA-2025-1738170434.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/centos8stream-els/CLSA-2025-1738265246.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/oraclelinux7-els/CLSA-2025-1739386458.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/centos7-els/CLSA-2025-1739388237.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2025-1740131776.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2025-1751142056.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1778236507.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12747.json","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-12747","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0019.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33920","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/01/14/3","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2025/msg00004.html","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-7206-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7206-2","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1060","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12085","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12086","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12087","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12088","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1061","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12084","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1062","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1063","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1064","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.0_release_notes/index","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-71293","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2025_6470.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-12084","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2330527","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-12084","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-12085","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2330539","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-12085","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-12086","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2330577","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-12086","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2330672","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-12087","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2330676","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-12088","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-12747","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2600.json","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.6_release_notes/index","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-18216","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-67142","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-70265","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7050.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:2600","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7050","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250156-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234100","tags":["report"]},{"url":"https://bugzilla.suse.com/1234101","tags":["report"]},{"url":"https://bugzilla.suse.com/1234102","tags":["report"]},{"url":"https://bugzilla.suse.com/1234103","tags":["report"]},{"url":"https://bugzilla.suse.com/1234104","tags":["report"]},{"url":"https://bugzilla.suse.com/1235475","tags":["report"]},{"url":"https://bugzilla.suse.com/1235895","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12747","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250157-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250165-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250166-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250991-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1237187","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520122-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520223-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262038-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1254441","tags":["report"]},{"url":"https://bugzilla.suse.com/1262223","tags":["report"]},{"url":"https://bugzilla.suse.com/1264511","tags":["report"]},{"url":"https://bugzilla.suse.com/1264512","tags":["report"]},{"url":"https://bugzilla.suse.com/1264513","tags":["report"]},{"url":"https://bugzilla.suse.com/1264514","tags":["report"]},{"url":"https://bugzilla.suse.com/1264515","tags":["report"]},{"url":"https://bugzilla.suse.com/1265296","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45232","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262048-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262083-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621726-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1201840","tags":["report"]},{"url":"https://bugzilla.suse.com/1202970","tags":["report"]},{"url":"https://bugzilla.suse.com/1204538","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29154","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-12747","tags":["report"]},{"url":"https://kb.cert.org/vince/comm/case/2083/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7206-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-12084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-12085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-12086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-12087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-12088","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-12747","title":"Rsync: race condition in rsync handling symbolic links","description":"A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.","status":"published","published":"2025-01-14T17:39:16.031Z","modified":"2026-11-05T11:45:15.026Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-362"],"updated_at":"2026-11-05T13:18:22.408512Z"}],"euvd":[{"id":"EUVD-2024-51084","description":"A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.","status":"published","published":"2025-01-14T17:39:16Z","modified":"2026-11-05T11:45:15Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-05T13:14:14.11293Z"}],"ghsa":[{"id":"GHSA-gp7r-m4cc-qhwq","title":"A flaw was found in rsync. This vulnerability arises from a race condition during rsync's...","description":"A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.","status":"published","published":"2025-01-14T18:32:00Z","modified":"2026-04-15T00:31:34Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:07:30.088478Z"}],"nvd":[{"id":"CVE-2024-12747","description":"A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.","status":"published","published":"2025-01-14T18:15:25.83Z","modified":"2026-11-05T12:17:46.12Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-362"],"updated_at":"2026-11-05T16:36:41.817182Z"}],"osv":[{"id":"ALPINE-CVE-2024-12747","description":"A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.","status":"published","published":"2025-01-14T18:15:25.83Z","modified":"2026-11-02T11:17:50.063659653Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2024-12747","status":"published","published":"2025-01-15T05:56:55.105282Z","modified":"2026-01-26T09:42:49.007672Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"CVE-2024-12747","title":"Rsync: race condition in rsync handling symbolic links","description":"A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.","status":"published","published":"2025-01-14T17:39:16.031Z","modified":"2026-11-07T02:31:06.591776789Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-362"],"updated_at":"2026-11-07T03:07:52.191907Z"},{"id":"DEBIAN-CVE-2024-12747","description":"A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.","status":"published","published":"2025-01-14T18:15:25.83Z","modified":"2026-11-02T12:00:26.299243283Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"OESA-2025-1060","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026quot;rsync algorithm\u0026quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-12085)\r\n\r\n(CVE-2024-12086)\r\n\r\n(CVE-2024-12087)\r\n\r\n(CVE-2024-12088)\r\n\r\n(CVE-2024-12747)","status":"published","published":"2025-01-17T11:08:09Z","modified":"2026-08-18T01:17:42.894875429Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1061","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026quot;rsync algorithm\u0026quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-12084)\r\n\r\n(CVE-2024-12085)\r\n\r\n(CVE-2024-12086)\r\n\r\n(CVE-2024-12087)\r\n\r\n(CVE-2024-12088)\r\n\r\n(CVE-2024-12747)","status":"published","published":"2025-01-17T11:08:09Z","modified":"2026-08-18T01:17:42.88623039Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1062","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026quot;rsync algorithm\u0026quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-12085)\r\n\r\n(CVE-2024-12086)\r\n\r\n(CVE-2024-12087)\r\n\r\n(CVE-2024-12088)\r\n\r\n(CVE-2024-12747)","status":"published","published":"2025-01-17T11:08:09Z","modified":"2026-08-18T01:17:42.754725306Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1063","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026quot;rsync algorithm\u0026quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-12085)\r\n\r\n(CVE-2024-12086)\r\n\r\n(CVE-2024-12087)\r\n\r\n(CVE-2024-12088)\r\n\r\n(CVE-2024-12747)","status":"published","published":"2025-01-17T11:08:09Z","modified":"2026-08-18T01:17:42.868723461Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1064","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026quot;rsync algorithm\u0026quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-12084)\r\n\r\n(CVE-2024-12085)\r\n\r\n(CVE-2024-12086)\r\n\r\n(CVE-2024-12087)\r\n\r\n(CVE-2024-12088)\r\n\r\n(CVE-2024-12747)","status":"published","published":"2025-01-17T11:08:09Z","modified":"2026-08-18T01:17:42.836740202Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"RHBA-2025:6470","title":"Red Hat Bug Fix Advisory: rsync bug fix and enhancement update","status":"published","published":"2025-07-08T10:03:37Z","modified":"2026-10-14T10:05:55Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2025:2600","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2025-03-11T10:06:22Z","modified":"2026-06-30T10:25:28Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:7050","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2025-05-13T10:04:58Z","modified":"2026-06-30T10:27:44Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RLSA-2025:2600","title":"Moderate: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: Path traversal vulnerability in rsync (CVE-2024-12087)\n\n* rsync: --safe-links option bypass leads to path traversal (CVE-2024-12088)\n\n* rsync: Race Condition in rsync Handling Symbolic Links (CVE-2024-12747)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-05-07T19:11:34.309952Z","modified":"2025-05-07T19:38:06.576875Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:7050","title":"Moderate: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: Path traversal vulnerability in rsync (CVE-2024-12087)\n\n* rsync: --safe-links option bypass leads to path traversal (CVE-2024-12088)\n\n* rsync: Race Condition in rsync Handling Symbolic Links (CVE-2024-12747)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.","status":"published","published":"2025-10-04T00:11:30.91642Z","modified":"2025-10-07T17:39:30.102884Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"UBUNTU-CVE-2024-12747","description":"A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.","status":"published","published":"2025-01-09T00:00:00Z","modified":"2026-02-04T04:31:50.96055Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"ALSA-2025:2600","title":"Moderate: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.  \n\nSecurity Fix(es):  \n\n  * rsync: Path traversal vulnerability in rsync (CVE-2024-12087)\n  * rsync: --safe-links option bypass leads to path traversal (CVE-2024-12088)\n  * rsync: Race Condition in rsync Handling Symbolic Links (CVE-2024-12747)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-03-11T00:00:00Z","modified":"2026-10-29T11:02:28.471160596Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:7050","title":"Moderate: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.  \n\nSecurity Fix(es):  \n\n  * rsync: Path traversal vulnerability in rsync (CVE-2024-12087)\n  * rsync: --safe-links option bypass leads to path traversal (CVE-2024-12088)\n  * rsync: Race Condition in rsync Handling Symbolic Links (CVE-2024-12747)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.\n","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:32:06.061358189Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"AZL-55673","title":"CVE-2024-12747 affecting package rsync for versions less than 3.4.1-1","description":"A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.","status":"published","published":"2025-01-14T18:15:25Z","modified":"2026-04-21T04:35:58.841001Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"AZL-55679","title":"CVE-2024-12747 affecting package rsync for versions less than 3.4.1-1","description":"A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.","status":"published","published":"2025-01-14T18:15:25Z","modified":"2026-04-21T04:55:23.39378Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"CLSA-2025-1737990875","title":"rsync: Fix of 2 CVEs","description":"- CVE-2024-12747: fix race condition during symbolic links handling\n- CVE-2024-12086: fix infoleak when connect to malicious server","status":"published","published":"2025-01-27T15:14:41Z","modified":"2026-10-21T10:48:05.829458029Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2025-1737990907","title":"rsync: Fix of 2 CVEs","description":"- CVE-2024-12747: fix race condition during symbolic links handling\n- CVE-2024-12086: fix infoleak when connect to malicious server","status":"published","published":"2025-01-27T15:15:14Z","modified":"2026-10-21T10:48:07.994840266Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2025-1738170434","title":"Fix CVE(s): CVE-2024-12747","description":"   * SECURITY UPDATE: race condition during rsync's handling of\n     symbolic links\n     - debian/patches/CVE-2024-12747.patch: prevent symlink race\n       preventing a normal file from being replaced by a symlink\n     - CVE-2024-12747\n   * debian/rules, debian/patches/series: use series file to manage patches\n   * debian/patches/ssh-6-option.diff make it compatible with Quilt","status":"published","published":"2025-01-29T17:07:20Z","modified":"2026-06-04T10:04:17.505396Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2025-1738265246","title":"rsync: Fix of CVE-2024-12747","description":"- CVE-2024-12747: fix symlink race conditions","status":"published","published":"2025-01-30T19:27:32Z","modified":"2026-06-01T00:32:57.675770166Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2025-1739386458","title":"rsync: Fix of CVE-2024-12747","description":"- CVE-2024-12747: fix symlink race condition in sender","status":"published","published":"2025-02-12T18:54:24Z","modified":"2026-06-01T00:32:56.66189366Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2025-1739388237","title":"rsync: Fix of CVE-2024-12747","description":"- CVE-2024-12747: fix symlink race condition in sender","status":"published","published":"2025-02-12T19:24:04Z","modified":"2026-06-01T00:33:17.942085641Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2025-1740131776","title":"Fix CVE(s): CVE-2024-12747","description":"   * SECURITY UPDATE: race condition during rsync's handling of\n     symbolic links\n     - debian/patches/CVE-2024-12747.patch: prevent symlink race\n       preventing a normal file from being replaced by a symlink\n     - CVE-2024-12747\n   * debian/rules, debian/patches/series: use series file to manage patches\n   * debian/patches/ssh-6-option.diff: adjust changes to align with the new patch\n     application approach.","status":"published","published":"2025-02-21T09:56:21Z","modified":"2026-06-04T10:03:17.005192Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2025-1751142056","title":"rsync: Fix of CVE-2024-12747","description":"- CVE-2024-12747: fix symlink race condition in sender","status":"published","published":"2025-06-28T20:21:01Z","modified":"2026-06-01T00:33:27.495640628Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2026-1778236507","title":"rsync: Fix of 3 CVEs","description":"- CVE-2025-10158: fix invalid access to files array in sender\n- CVE-2024-12747: fix symlink race condition in sender\n- CVE-2024-12086: fix server leak of arbitrary client files via crafted checksums and fuzzy basis","status":"published","published":"2026-05-08T10:35:12Z","modified":"2026-10-21T10:45:54.817187608Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"DLA-4015-1","title":"rsync - security update","status":"published","published":"2025-01-14T00:00:00Z","modified":"2026-03-09T01:22:12.663327Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5843-1","title":"rsync - security update","status":"published","published":"2025-01-14T00:00:00Z","modified":"2026-03-09T02:09:48.977956Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2025-0019","title":"Updated rsync packages fix security vulnerabilities","description":"Heap buffer overflow in rsync due to improper checksum length handling.\n(CVE-2024-12084)\nInfo leak via uninitialized stack contents. (CVE-2024-12085)\nRsync server leaks arbitrary client files. (CVE-2024-12086)\nPath traversal vulnerability in rsync. (CVE-2024-12087)\nRsync --safe-links option bypass leads to path traversal.\n(CVE-2024-12088)\nRace condition in rsync handling symbolic links. (CVE-2024-12747)\n","status":"published","published":"2025-01-22T03:19:16Z","modified":"2026-04-16T04:40:55.151740976Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2025:14665-1","title":"rsync-3.4.1-1.1 on GA media","description":"These are all security issues fixed in the rsync-3.4.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-18T00:00:00Z","modified":"2026-02-04T02:52:31.427536Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2025:0156-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2024-12084: heap buffer overflow in checksum parsing. (bsc#1234100)\n- CVE-2024-12085: leak of uninitialized stack data on the server leading to possible ASLR bypass. (bsc#1234101)\n- CVE-2024-12086: leak of a client machine's file contents through the processing of checksum data. (bsc#1234102)\n- CVE-2024-12087: arbitrary file overwrite possible on clients when symlink syncing is enabled. (bsc#1234103)\n- CVE-2024-12088: bypass of the --safe-links flag may allow the placement of unsafe symlinks in a client. (bsc#1234104)\n- CVE-2024-12747: race condition in rsync handling symbolic links (bsc#1235475)\n","status":"published","published":"2025-01-17T11:59:08Z","modified":"2026-02-04T03:03:32.541234Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:0157-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2024-12085: leak of uninitialized stack data on the server leading to possible ASLR bypass. (bsc#1234101)\n- CVE-2024-12086: leak of a client machine's file contents through the processing of checksum data. (bsc#1234102)\n- CVE-2024-12087: arbitrary file overwrite possible on clients when symlink syncing is enabled. (bsc#1234103)\n- CVE-2024-12088: bypass of the --safe-links flag may allow the placement of unsafe symlinks in a client. (bsc#1234104)\n- CVE-2024-12747: Fixed a race condition in rsync handling symbolic links. (bsc#1235475)\n","status":"published","published":"2025-01-17T11:59:43Z","modified":"2025-05-02T04:36:17.198496Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:0165-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2024-12085: leak of uninitialized stack data on the server leading to possible ASLR bypass. (bsc#1234101)\n- CVE-2024-12086: leak of a client machine's file contents through the processing of checksum data. (bsc#1234102)\n- CVE-2024-12087: arbitrary file overwrite possible on clients when symlink syncing is enabled. (bsc#1234103)\n- CVE-2024-12088: bypass of the --safe-links flag may allow the placement of unsafe symlinks in a client. (bsc#1234104)\n- CVE-2024-12747: Fixed a race condition in rsync handling symbolic links. (bsc#1235475)\n","status":"published","published":"2025-01-17T16:09:34Z","modified":"2026-02-04T03:48:30.617711Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:0166-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2024-12085: leak of uninitialized stack data on the server leading to possible ASLR bypass. (bsc#1234101)\n- CVE-2024-12086: leak of a client machine's file contents through the processing of checksum data. (bsc#1234102)\n- CVE-2024-12087: arbitrary file overwrite possible on clients when symlink syncing is enabled. (bsc#1234103)\n- CVE-2024-12088: bypass of the --safe-links flag may allow the placement of unsafe symlinks in a client. (bsc#1234104)\n- CVE-2024-12747: Fixed a race condition in handling symbolic links. (bsc#1235475)\n","status":"published","published":"2025-01-17T16:09:43Z","modified":"2026-02-04T04:12:38.928189Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:0991-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2024-12747: Fixed race condition in handling symbolic links (bsc#1235475)\n\n- Broken rsyncd after protocol bump, regression reported (bsc#1237187).\n- Bump protocol version to 32 - make it easier to show server is patched. \n\n","status":"published","published":"2025-03-24T13:56:41Z","modified":"2026-02-04T03:28:12.789373Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:20122-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2024-12084: Fixed Heap Buffer Overflow in Checksum Parsing (bsc#1234100).\n- CVE-2024-12085: Fixed Info Leak via uninitialized Stack contents defeating ASLR (bsc#1234101).\n- CVE-2024-12086: Fixed server leaking arbitrary client files (bsc#1234102).\n- CVE-2024-12087: Fixed server use of symbolic links to  make client write files outside of destination directory (bsc#1234103).\n- CVE-2024-12088: Fixed --safe-links bypass (bsc#1234104).\n- CVE-2024-12747: Fixed Race Condition in rsync Handling Symbolic Links (bsc#1235475).\n","status":"published","published":"2025-02-04T08:59:54Z","modified":"2026-03-23T04:50:03.558329Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20223-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- Bump protocol version to 32 - make it easier to show server is patched. \n\n- Fix FLAG_GOT_DIR_FLIST collission with FLAG_HLINKED\n\n- Security update,CVE-2024-12747, bsc#1235475 race condition in handling symbolic links\n \n- Security update, fix multiple vulnerabilities:\n  * CVE-2024-12084, bsc#1234100 - Heap Buffer Overflow in Checksum Parsing\n  * CVE-2024-12085, bsc#1234101 - Info Leak via uninitialized Stack contents defeats ASLR\n  * CVE-2024-12086, bsc#1234102 - Server leaks arbitrary client files\n  * CVE-2024-12087, bsc#1234103 - Server can make client write files outside of destination directory using symbolic links\n  * CVE-2024-12088, bsc#1234104 - --safe-links Bypass\n","status":"published","published":"2025-02-07T09:56:49Z","modified":"2026-03-23T04:48:12.144871Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2026:2038-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n    \n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-41035: Count of entries mismatch can lead to a use-after-free (bsc#1262223)\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-05-21T13:33:41Z","modified":"2026-05-22T09:00:05.164069318Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:2048-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-05-25T13:55:42Z","modified":"2026-05-26T08:15:05.350251039Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:2083-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-05-27T07:56:11Z","modified":"2026-05-28T08:15:05.799079873Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:21726-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\nSecurity issues:\n\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n\nNon security issues:\n\n- rsync --delay-updates never updates after interruption (bsc#1204538).\n- Fix duplication of flag causing illegal hashkey failures.\n","status":"published","published":"2026-05-21T11:04:19Z","modified":"2026-05-23T18:23:40.42363199Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"USN-7206-1","title":"Several security issues were fixed in rsync","description":"Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync\ndid not properly handle checksum lengths. An attacker could use this\nissue to execute arbitrary code. (CVE-2024-12084)\n\nSimon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync\ncompared checksums with uninitialized memory. An attacker could exploit\nthis issue to leak sensitive information. (CVE-2024-12085)\n\nSimon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync\nincorrectly handled file checksums. A malicious server could use this\nto expose arbitrary client files. (CVE-2024-12086)\n\nSimon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync\nmishandled symlinks for some settings. An attacker could exploit this\nto write files outside the intended directory. (CVE-2024-12087)\n\nSimon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync\nfailed to verify symbolic link destinations for some settings. An\nattacker could exploit this for path traversal attacks. (CVE-2024-12088)\n\nAleksei Gorban discovered a race condition in rsync's handling of\nsymbolic links. An attacker could use this to access sensitive\ninformation or escalate privileges. (CVE-2024-12747)\n","status":"published","published":"2025-01-14T23:32:20Z","modified":"2026-06-25T13:32:30.086799112Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}