Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
rsync could allow unauthorized file access
published 1 year ago
Summary
The rsync program used on CentOS systems can be tricked into following symbolic links that point outside allowed directories, potentially exposing private files. It also has a bug that could leak memory information. Update rsync and the rsync‑daemon package to the latest versions provided by your vendor to close these gaps.
What to do
- Update centos rsync to version 3.1.3-12.el8.tuxcare.els5.
- Update centos rsync-daemon to version 3.1.3-12.el8.tuxcare.els5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:CentOS:8.5 | centos | rsync |
< 3.1.3-12.el8.tuxcare.els5 Fix: upgrade to 3.1.3-12.el8.tuxcare.els5
|
| TuxCare:CentOS:8.5 | centos | rsync-daemon |
< 3.1.3-12.el8.tuxcare.els5 Fix: upgrade to 3.1.3-12.el8.tuxcare.els5
|
Original advisory text
rsync: Fix of 2 CVEs
- CVE-2024-12088: fix path traversal vulnerability by properly verifying
symbolic link destinations
- CVE-2024-12085: fix issue with checksum length manipulation leading to
uninitialized memory leak
symbolic link destinations
- CVE-2024-12085: fix issue with checksum length manipulation leading to
uninitialized memory leak
References
Timeline
Published21 Jan 2025
Updated21 Oct 2026
First seen21 Oct 2026
Sources
CLSA-2025-1737464920 · OSV
Track software like this
Free during beta