Affected: AlmaLinux:8: rsync, AlmaLinux:8: rsync-daemon

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

* rsync: Path traversal vulnerability in rsync (CVE-2024-12087) * rsync: --safe-links option bypass leads to path traversal (CVE-2024-12088) * rsync: Race Condition in rsync Handling Symbolic Links (CVE-2024-12747)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected: Alpaquita:23: rsync, Alpaquita:stream: rsync

A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.

A flaw was found in rsync. When using the `--safe-links` option, rsync fails to properly verify if a symbolic link destination contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.

Affected: openEuler:22.03-LTS-SP4: rsync

Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand. Security Fix(es): (CVE-2024-12085) (CVE-2024-12086) (CVE-2024-12087) (CVE-2024-12088) (CVE-2024-12747)

rsync-3.4.1-1.1 on GA media

vim: use-after-free in function ins_compl_get_exp in vim/vim libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat rsync: Path traversal vulnerability in rsync rsync: --safe-links option bypass leads to path traversal libtasn1: Inefficient DER Decoding in libtasn1 Leading to Potential Remote DoS gnutls: GnuTLS Impacted by Inefficient DER Decoding in libtasn1 Leading to Remote DoS rsync: Race Condition in rsync Handling Symbolic Links requests: subsequent requests to the same host ignore cert verification git: The sideband payload is passed unfiltered to the terminal in git python: cpython: URL parser allowed square brackets in domain names krb5: overflow when calculating ulog block size openssh: Machine-in-the-middle attack if VerifyHostKeyDNS is enabled

Security update for rsync

Affected: Ubuntu:Pro:14.04:LTS: rsync, Ubuntu:Pro:16.04:LTS: rsync, Ubuntu:Pro:18.04:LTS: rsync, Ubuntu:20.04:LTS: rsync, Ubuntu:22.04:LTS: rsync, Ubuntu:24.04:LTS: rsync

A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.

Coreutils: heap overflow in split --line-bytes with very long lines Unprivileged overlay + shiftfs read access Nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file SSL_select_next_proto buffer overread Remote Code Execution in pypa/setuptools

Ein Angreifer kann mehrere Schwachstellen in Rsync ausnutzen, um vertrauliche Informationen preiszugeben, sich erhöhte Rechte zu verschaffen und Daten zu manipulieren.