Medium severity6.1NVD Advisory· Published Jan 14, 2025· Updated May 26, 2026

CVE-2024-12086

Description

A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Red Hat/Openshift Container Platform
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
Samba (software)/Rsync
cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*
Range: <=3.3.0
Almalinux/Almalinux3 versions
cpe:2.3:o:almalinux:almalinux:10.0:-:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:almalinux:almalinux:10.0:-:*:*:*:*:*:*
- cpe:2.3:o:almalinux:almalinux:8.0:-:*:*:*:*:*:*
- cpe:2.3:o:almalinux:almalinux:9.0:-:*:*:*:*:*:*
Archlinux/Arch Linux
cpe:2.3:o:archlinux:arch_linux:-:*:*:*:*:*:*:*
File Project/Linux
cpe:2.3:o:gentoo:linux:-:*:*:*:*:*:*:*
Nixos/Nixos
cpe:2.3:o:nixos:nixos:*:*:*:*:*:*:*:*
Range: <24.11
Red Hat/Enterprise Linux Server5 versions
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
SUSE S.A./Linux
cpe:2.3:o:suse:suse_linux:-:*:*:*:*:*:*:*
Tritondatacenter/Smartos
cpe:2.3:o:tritondatacenter:smartos:*:*:*:*:*:*:*:*
Range: <20250123
Rsync/Rsyncllm-fuzzy
osv-coords30 versions
pkg:deb/ubuntu/rsync@3.3.0-1ubuntu0.1?arch=source&distro=oracular pkg:rpm/almalinux/rsync pkg:rpm/almalinux/rsync-daemon pkg:rpm/almalinux/rsync-rrsync pkg:rpm/opensuse/rsync&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/rsync&distro=openSUSE%20Tumbleweed pkg:rpm/suse/rsync&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Micro%205.1 pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Micro%205.2 pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Micro%205.3 pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Micro%205.4 pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Micro%205.5 pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP6 pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5 pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Micro%206.0 pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Micro%206.1 pkg:rpm/suse/rsync&distro=SUSE%20Manager%20Proxy%204.3 pkg:rpm/suse/rsync&distro=SUSE%20Manager%20Server%204.3
< 3.3.0-1ubuntu0.1+ 29 more
- (no CPE)range: < 3.3.0-1ubuntu0.1
- (no CPE)range: < 3.2.5-7.el9_8
- (no CPE)range: < 3.2.5-7.el9_8
- (no CPE)range: < 3.2.5-7.el9_8
- (no CPE)range: < 3.2.7-150600.3.8.1
- (no CPE)range: < 3.4.1-1.1
- (no CPE)range: < 3.2.3-150000.4.33.1
- (no CPE)range: < 3.2.3-150000.4.33.1
- (no CPE)range: < 3.2.3-150400.3.17.1
- (no CPE)range: < 3.2.3-150400.3.17.1
- (no CPE)range: < 3.2.3-150400.3.17.1
- (no CPE)range: < 3.2.3-150400.3.17.1
- (no CPE)range: < 3.2.3-150000.4.33.1
- (no CPE)range: < 3.2.3-150000.4.33.1
- (no CPE)range: < 3.2.3-150400.3.17.1
- (no CPE)range: < 3.2.3-150400.3.17.1
- (no CPE)range: < 3.2.3-150400.3.17.1
- (no CPE)range: < 3.2.7-150600.3.8.1
- (no CPE)range: < 3.1.3-3.22.1
- (no CPE)range: < 3.2.3-150000.4.33.1
- (no CPE)range: < 3.2.3-150400.3.17.1
- (no CPE)range: < 3.2.3-150400.3.17.1
- (no CPE)range: < 3.2.3-150000.4.33.1
- (no CPE)range: < 3.2.3-150400.3.17.1
- (no CPE)range: < 3.2.3-150400.3.17.1
- (no CPE)range: < 3.1.3-3.22.1
- (no CPE)range: < 3.2.7-4.1
- (no CPE)range: < 3.3.0-slfo.1.1_3.1
- (no CPE)range: < 3.2.3-150400.3.17.1
- (no CPE)range: < 3.2.3-150400.3.17.1

Patches

Vulnerability mechanics

References

github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqjnvdExploitThird Party Advisory
access.redhat.com/security/cve/CVE-2024-12086nvdThird Party Advisory
bugzilla.redhat.com/show_bug.cginvdIssue TrackingThird Party Advisory
kb.cert.org/vuls/id/952657nvdThird Party Advisory
access.redhat.com/errata/RHBA-2025:6470nvd
access.redhat.com/errata/RHSA-2026:19368nvd
access.redhat.com/errata/RHSA-2026:20603nvd
lists.debian.org/debian-lts-announce/2025/01/msg00008.htmlnvd
security.netapp.com/advisory/ntap-20250131-0002/nvd
www.kb.cert.org/vuls/id/952657nvd

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000