Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2024-12086

Rsync: rsync server leaks arbitrary client files

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

rsync

Default version status: unaffected

  • 0 to ≤ 3.3.0affected

Red Hat Red Hat Enterprise Linux 10

Default version status: affected

  • 0:3.4.1-2.el10 to < *unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

  • 0:3.2.5-7.el9_8 to < *unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

  • 0:3.2.5-7.el9_8 to < *unaffected

Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support

Default version status: affected

  • 0:3.2.5-3.el9_6.1 to < *unaffected

Red Hat Red Hat Discovery 2

Default version status: affected

  • 1782166952 to < *unaffected

Red Hat Red Hat Enterprise Linux 6

Default version status: unknown

Red Hat Red Hat Enterprise Linux 7

Default version status: unknown

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: affected

References