Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Rsync for Linux Users: Unauthorized File Access Risk

published 1 year ago

Summary

A security update has been released for the rsync utility on Linux systems. This update fixes a vulnerability that could allow an attacker to access files they shouldn't be able to access. If you're using rsync on a Linux system, we recommend updating to the latest version to ensure you have the latest security patches.

What to do

Update redhat rsync to version 0:3.1.3-7.el8_2.5.
Update redhat rsync-daemon to version 0:3.1.3-7.el8_2.5.
Update redhat rsync-debuginfo to version 0:3.1.3-7.el8_2.5.
Update redhat rsync-debugsource to version 0:3.1.3-7.el8_2.5.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_aus:8.2::baseos	redhat	rsync	< 0:3.1.3-7.el8_2.5 Fix: upgrade to 0:3.1.3-7.el8_2.5
Red Hat:rhel_aus:8.2::baseos	redhat	rsync-daemon	< 0:3.1.3-7.el8_2.5 Fix: upgrade to 0:3.1.3-7.el8_2.5
Red Hat:rhel_aus:8.2::baseos	redhat	rsync-debuginfo	< 0:3.1.3-7.el8_2.5 Fix: upgrade to 0:3.1.3-7.el8_2.5
Red Hat:rhel_aus:8.2::baseos	redhat	rsync-debugsource	< 0:3.1.3-7.el8_2.5 Fix: upgrade to 0:3.1.3-7.el8_2.5

Original advisory text

Red Hat Security Advisory: rsync security update

References

https://access.redhat.com/errata/RHSA-2025:11048 Vendor Advisory
https://access.redhat.com/security/updates/classification/#low Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1402345 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11048.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2016-9840 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2016-9840 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-9840 Vendor Advisory
https://docs.google.com/document/d/10i1KZS5so8xDqH2rplRa2xet0tyTvvJlLbQQmZIUIKE/... Third Party Advisory
https://wiki.mozilla.org/images/0/09/Zlib-report.pdf Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.8 High

Timeline

Published15 Jul 2025

Updated25 Mar 2026

First seen25 Mar 2026

Sources

RHSA-2025:11048 · OSV

Track software like this

Free during beta