rpm package
almalinux/rsync-rrsync
pkg:rpm/almalinux/rsync-rrsync
Vulnerabilities (29)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-70464 | Hig | 7.5 | < 3.2.7-1.el9_8 | 3.2.7-1.el9_8 | Aug 13, 2026 | rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open man | |
| CVE-2026-70463 | Hig | 8.1 | < 3.2.7-1.el9_8 | 3.2.7-1.el9_8 | Aug 13, 2026 | rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The s | |
| CVE-2026-70461 | Hig | 8.2 | < 3.2.7-1.el9_8 | 3.2.7-1.el9_8 | Aug 13, 2026 | rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against | |
| CVE-2026-70460 | Hig | 8.1 | < 3.2.7-1.el9_8 | 3.2.7-1.el9_8 | Aug 13, 2026 | rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the | |
| CVE-2026-70458 | Hig | 8.2 | < 3.2.7-1.el9_8 | 3.2.7-1.el9_8 | Aug 13, 2026 | rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing | |
| CVE-2026-70457 | Med | 6.5 | < 3.2.7-1.el9_8 | 3.2.7-1.el9_8 | Aug 13, 2026 | rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number | |
| CVE-2026-70456 | Hig | 8.2 | < 3.2.7-1.el9_8 | 3.2.7-1.el9_8 | Aug 13, 2026 | rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailin | |
| CVE-2026-70455 | Hig | 7.5 | < 3.5.0-3.el10_2 | 3.5.0-3.el10_2 | Aug 13, 2026 | rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can | |
| CVE-2026-70454 | Hig | 8.0 | < 3.2.7-1.el9_8 | 3.2.7-1.el9_8 | Aug 13, 2026 | rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit | |
| CVE-2026-70453 | Hig | 7.5 | < 3.2.7-1.el9_8 | 3.2.7-1.el9_8 | Aug 13, 2026 | rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookup | |
| CVE-2026-70452 | Hig | 7.4 | < 3.2.7-1.el9_8 | 3.2.7-1.el9_8 | Aug 13, 2026 | rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the da | |
| CVE-2026-53803 | Hig | 7.8 | < 3.2.7-1.el9_8 | 3.2.7-1.el9_8 | Aug 13, 2026 | rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failu | |
| CVE-2026-53802 | Hig | 7.1 | < 3.2.7-1.el9_8 | 3.2.7-1.el9_8 | Aug 13, 2026 | rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attack | |
| CVE-2026-53795 | Hig | 8.1 | < 3.2.7-1.el9_8 | 3.2.7-1.el9_8 | Aug 13, 2026 | rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve t | |
| CVE-2026-53793 | Hig | 7.4 | < 3.2.7-1.el9_8 | 3.2.7-1.el9_8 | Aug 13, 2026 | rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can ex | |
| CVE-2026-53791 | Cri | 9.1 | < 3.2.7-1.el9_8 | 3.2.7-1.el9_8 | Aug 13, 2026 | rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon | |
| CVE-2026-53790 | Hig | 8.1 | < 3.2.7-1.el9_8 | 3.2.7-1.el9_8 | Aug 13, 2026 | rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapp | |
| CVE-2026-53789 | Med | 6.5 | < 3.2.7-1.el9_8 | 3.2.7-1.el9_8 | Aug 13, 2026 | rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or | |
| CVE-2026-53785 | Hig | 7.1 | < 3.2.7-1.el9_8 | 3.2.7-1.el9_8 | Aug 13, 2026 | rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outsi | |
| CVE-2026-53784 | Hig | 7.1 | < 3.2.7-1.el9_8 | 3.2.7-1.el9_8 | Aug 13, 2026 | rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session in |
- affected < 3.2.7-1.el9_8fixed 3.2.7-1.el9_8
rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open man
- affected < 3.2.7-1.el9_8fixed 3.2.7-1.el9_8
rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The s
- affected < 3.2.7-1.el9_8fixed 3.2.7-1.el9_8
rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against
- affected < 3.2.7-1.el9_8fixed 3.2.7-1.el9_8
rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the
- affected < 3.2.7-1.el9_8fixed 3.2.7-1.el9_8
rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing
- affected < 3.2.7-1.el9_8fixed 3.2.7-1.el9_8
rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number
- affected < 3.2.7-1.el9_8fixed 3.2.7-1.el9_8
rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailin
- affected < 3.5.0-3.el10_2fixed 3.5.0-3.el10_2
rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can
- affected < 3.2.7-1.el9_8fixed 3.2.7-1.el9_8
rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit
- affected < 3.2.7-1.el9_8fixed 3.2.7-1.el9_8
rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookup
- affected < 3.2.7-1.el9_8fixed 3.2.7-1.el9_8
rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the da
- affected < 3.2.7-1.el9_8fixed 3.2.7-1.el9_8
rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failu
- affected < 3.2.7-1.el9_8fixed 3.2.7-1.el9_8
rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attack
- affected < 3.2.7-1.el9_8fixed 3.2.7-1.el9_8
rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve t
- affected < 3.2.7-1.el9_8fixed 3.2.7-1.el9_8
rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can ex
- affected < 3.2.7-1.el9_8fixed 3.2.7-1.el9_8
rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon
- affected < 3.2.7-1.el9_8fixed 3.2.7-1.el9_8
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapp
- affected < 3.2.7-1.el9_8fixed 3.2.7-1.el9_8
rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or
- affected < 3.2.7-1.el9_8fixed 3.2.7-1.el9_8
rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outsi
- affected < 3.2.7-1.el9_8fixed 3.2.7-1.el9_8
rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session in
Page 1 of 2