Affected: AlmaLinux:9: rsync, AlmaLinux:9: rsync-daemon

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

* rsync: Info Leak via Uninitialized Stack Contents (CVE-2024-12085)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected: Alpaquita:23: rsync, Alpaquita:stream: rsync

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.

A flaw was found in the rsync daemon which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.

Affected: openEuler:22.03-LTS-SP4: rsync

Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand. Security Fix(es): (CVE-2024-12085) (CVE-2024-12086) (CVE-2024-12087) (CVE-2024-12088) (CVE-2024-12747)

rsync-3.4.1-1.1 on GA media

PostCSS: Improper input validation in PostCSS golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS containers/image: digest type does not guarantee valid type go-retryablehttp: url might write sensitive information to log file openshift-console: OAuth2 insufficient state parameter entropy openshift/builder: Path traversal allows command injection in privileged BuildContainer using docker build strategy Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library pam: Improper Hostname Interpretation in pam_access Leads to Access Control Bypass rsync: Info Leak via Uninitialized Stack Contents ose-olm-catalogd-container: incomplete fix for rapid reset (CVE-2023-39325/CVE-2023-44487) cross-spawn: regular expression denial of service golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON axios: axios: Server-Side Request Forgery Bare Metal Operator: BMO can expose particularly named secrets from other namespaces via BMH CRD path-to-regexp: Backtracking regular expressions cause ReDoS golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html openshift-controller-manager: Elevated Build Pods Can Lead to Node Compromise in OpenShift openstack-ironic: Lack of checksum validation on images dompurify: DOMPurify vulnerable to tampering by prototype pollution GraphQL: Denial of Service (DoS) v…

Security update for rsync

Affected: Ubuntu:Pro:14.04:LTS: rsync, Ubuntu:Pro:16.04:LTS: rsync, Ubuntu:Pro:18.04:LTS: rsync, Ubuntu:20.04:LTS: rsync, Ubuntu:22.04:LTS: rsync, Ubuntu:24.04:LTS: rsync

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.

Coreutils: heap overflow in split --line-bytes with very long lines Unprivileged overlay + shiftfs read access Nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file SSL_select_next_proto buffer overread Remote Code Execution in pypa/setuptools

Ein Angreifer kann mehrere Schwachstellen in Rsync ausnutzen, um vertrauliche Informationen preiszugeben, sich erhöhte Rechte zu verschaffen und Daten zu manipulieren.