Medium severity6.5NVD Advisory· Published Jan 14, 2025· Updated Apr 14, 2026

CVE-2024-12088

Description

A flaw was found in rsync. When using the --safe-links option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Red Hat/Discovery
cpe:2.3:a:redhat:discovery:1.14:*:*:*:*:*:*:*
Red Hat/Openshift Container Platform
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
Samba (software)/Rsync
cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*
Range: <=3.3.0
Almalinux/Almalinux3 versions
cpe:2.3:o:almalinux:almalinux:10.0:-:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:almalinux:almalinux:10.0:-:*:*:*:*:*:*
- cpe:2.3:o:almalinux:almalinux:8.0:-:*:*:*:*:*:*
- cpe:2.3:o:almalinux:almalinux:9.0:-:*:*:*:*:*:*
Archlinux/Arch Linux
cpe:2.3:o:archlinux:arch_linux:-:*:*:*:*:*:*:*
File Project/Linux
cpe:2.3:o:gentoo:linux:-:*:*:*:*:*:*:*
Nixos/Nixos
cpe:2.3:o:nixos:nixos:*:*:*:*:*:*:*:*
Range: <24.11
Novell/Suse Linux
cpe:2.3:o:novell:suse_linux:-:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server5 versions
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Eus
cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*
Red Hat/Enterprise Linux For Arm 642 versions
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:*
Red Hat/Enterprise Linux For Ibm Z Systems Eus2 versions
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.6_aarch64:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.6_aarch64:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:*
Red Hat/Enterprise Linux For Ibm Z Systems2 versions
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*
Red Hat/Enterprise Linux For Power Little Endian2 versions
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*
Red Hat/Enterprise Linux For Power Little Endian Eus
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server Aus
cpe:2.3:o:redhat:enterprise_linux_server_aus:9.6:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.6_ppc64le:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Update Services For Sap Solutions
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.6:*:*:*:*:*:*:*
Tritondatacenter/Smartos
cpe:2.3:o:tritondatacenter:smartos:*:*:*:*:*:*:*:*
Range: <20250123
Rsync/Rsyncllm-fuzzy
osv-coords30 versions
pkg:deb/ubuntu/rsync@3.3.0-1ubuntu0.1?arch=source&distro=oracular pkg:rpm/almalinux/rsync pkg:rpm/almalinux/rsync-daemon pkg:rpm/almalinux/rsync-rrsync pkg:rpm/opensuse/rsync&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/rsync&distro=openSUSE%20Tumbleweed pkg:rpm/suse/rsync&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Micro%205.1 pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Micro%205.2 pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Micro%205.3 pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Micro%205.4 pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Micro%205.5 pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP6 pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5 pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Micro%206.0 pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Micro%206.1 pkg:rpm/suse/rsync&distro=SUSE%20Manager%20Proxy%204.3 pkg:rpm/suse/rsync&distro=SUSE%20Manager%20Server%204.3
< 3.3.0-1ubuntu0.1+ 29 more
- (no CPE)range: < 3.3.0-1ubuntu0.1
- (no CPE)range: < 3.1.3-21.el8_10
- (no CPE)range: < 3.1.3-21.el8_10
- (no CPE)range: < 3.2.5-3.el9
- (no CPE)range: < 3.2.7-150600.3.8.1
- (no CPE)range: < 3.4.1-1.1
- (no CPE)range: < 3.2.3-150000.4.33.1
- (no CPE)range: < 3.2.3-150000.4.33.1
- (no CPE)range: < 3.2.3-150400.3.17.1
- (no CPE)range: < 3.2.3-150400.3.17.1
- (no CPE)range: < 3.2.3-150400.3.17.1
- (no CPE)range: < 3.2.3-150400.3.17.1
- (no CPE)range: < 3.2.3-150000.4.33.1
- (no CPE)range: < 3.2.3-150000.4.33.1
- (no CPE)range: < 3.2.3-150400.3.17.1
- (no CPE)range: < 3.2.3-150400.3.17.1
- (no CPE)range: < 3.2.3-150400.3.17.1
- (no CPE)range: < 3.2.7-150600.3.8.1
- (no CPE)range: < 3.1.3-3.22.1
- (no CPE)range: < 3.2.3-150000.4.33.1
- (no CPE)range: < 3.2.3-150400.3.17.1
- (no CPE)range: < 3.2.3-150400.3.17.1
- (no CPE)range: < 3.2.3-150000.4.33.1
- (no CPE)range: < 3.2.3-150400.3.17.1
- (no CPE)range: < 3.2.3-150400.3.17.1
- (no CPE)range: < 3.1.3-3.22.1
- (no CPE)range: < 3.2.7-4.1
- (no CPE)range: < 3.3.0-slfo.1.1_3.1
- (no CPE)range: < 3.2.3-150400.3.17.1
- (no CPE)range: < 3.2.3-150400.3.17.1

Patches

Vulnerability mechanics

References

access.redhat.com/errata/RHSA-2025:2600nvdThird Party Advisory
access.redhat.com/errata/RHSA-2025:7050nvdThird Party Advisory
access.redhat.com/errata/RHSA-2025:8385nvdThird Party Advisory
access.redhat.com/security/cve/CVE-2024-12088nvdThird Party Advisory
bugzilla.redhat.com/show_bug.cginvdIssue TrackingThird Party Advisory
github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqjnvdThird Party Advisory
kb.cert.org/vuls/id/952657nvdThird Party Advisory
access.redhat.com/errata/RHBA-2025:6470nvd
lists.debian.org/debian-lts-announce/2025/01/msg00008.htmlnvd
security.netapp.com/advisory/ntap-20250131-0002/nvd
www.kb.cert.org/vuls/id/952657nvd

News mentions

GitLab Patch Release: 18.1.2, 18.0.4, 17.11.6
GitLab Security Releases · Jul 9, 2025

cvss	0.423
epss	0.004
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000