Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.4
CVE-2022-29154: rsync before 3.2.5: Malicious servers can write files to your directories
CVE-2022-29154 · published 4 years ago
Summary
A security issue in rsync before version 3.2.5 allows a malicious server to write files into your connected directories. This could potentially allow an attacker to overwrite important files, such as your SSH keys. To protect yourself, update to the latest version of rsync (at least 3.2.5) as soon as possible.
What to do
- Update debian rsync to version 3.2.5-1.
- Update canonical rsync to version 3.1.2-2.1ubuntu1.6.
- Update canonical rsync to version 3.1.3-8ubuntu0.5.
- Update canonical rsync to version 3.2.7-0ubuntu0.22.04.2.
- Update samba rsync to version 3.2.5 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | rsync |
< 3.2.5-1 Fix: upgrade to 3.2.5-1
|
| Debian:13 | debian | rsync |
< 3.2.5-1 Fix: upgrade to 3.2.5-1
|
| Debian:14 | debian | rsync |
< 3.2.5-1 Fix: upgrade to 3.2.5-1
|
| Ubuntu:Pro:14.04:LTS | canonical | rsync | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | rsync | All versions |
| Ubuntu:18.04:LTS | canonical | rsync |
< 3.1.2-2.1ubuntu1.6 Fix: upgrade to 3.1.2-2.1ubuntu1.6
|
| Ubuntu:20.04:LTS | canonical | rsync |
< 3.1.3-8ubuntu0.5 Fix: upgrade to 3.1.3-8ubuntu0.5
|
| Ubuntu:22.04:LTS | canonical | rsync |
< 3.2.7-0ubuntu0.22.04.2 Fix: upgrade to 3.2.7-0ubuntu0.22.04.2
|
| – | samba | rsync |
< 3.2.5 cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
35 36 cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* |
Original advisory text
An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories ar...
An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).
References
- https://download.samba.org/pub/rsync/NEWS Third Party Advisory
- https://ubuntu.com/security/CVE-2022-29154 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29154... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-29154 Vendor Advisory
- https://lists.samba.org/archive/rsync/2022-August/032860.html Third Party Advisory
- https://ubuntu.com/security/notices/USN-5921-1 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-29154 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2022-29154 Vendor Advisory
- https://github.com/WayneD/rsync/tags URL
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
- http://www.openwall.com/lists/oss-security/2022/08/02/1 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-20Improper Input Validation
Timeline
Published2 Aug 2022
Updated3 Nov 2026
First seen23 May 2026
Sources
CVE-2022-29154 · OSV
UBUNTU-CVE-2022-29154 · OSV
CVE-2022-29154 · NVD
DEBIAN-CVE-2022-29154 · OSV
Track software like this
Free during beta