Read the docs
TI-2024-11819 Aliases CVE-2024-12747GHSA-gp7r-m4cc-qhwq

Rsync: race condition in rsync handling symbolic links

Priority LOW 25CWE-362Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 6 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00385 32nd percentileScored 2026-11-07
Fix Partial Red Hat: 3 advisoriesRed Hat: 6 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—rsyncup to 3.3.0—No fix listedCNA
Red HatRed Hat Enterprise Linux 10—3.4.1-2.el10Patch availableCNA
Red HatRed Hat Enterprise Linux 8—3.1.3-21.el8_10Patch availableCNA
Red HatRed Hat Enterprise Linux 9—3.2.5-3.el9Patch availableCNA
Red HatRed Hat Enterprise Linux 9—3.2.5-3.el9Patch availableCNA
Red HatRed Hat Discovery 1.14—1.14.2-1748467619Patch availableCNA
Red HatRed Hat Enterprise Linux 6——No fix listedCNA
Red HatRed Hat Enterprise Linux 7——No fix listedCNA
Red HatRed Hat OpenShift Container Platform 4——No fix listedCNA
  • rsync Vendor— Affected up to 3.3.0 Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 3.4.1-2.el10 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 3.1.3-21.el8_10 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 3.2.5-3.el9 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 3.2.5-3.el9 Patch available CNA
  • Red Hat Discovery 1.14 VendorRed Hat Affected — Fixed in 1.14.2-1748467619 Patch available CNA
  • Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA

CPE names CNA · 8

CPEVersionsRoleVendor
cpe:/o:redhat:enterprise_linux:10.010.0—Red Hat
cpe:/o:redhat:enterprise_linux:8::baseos8—Red Hat
cpe:/a:redhat:enterprise_linux:9::appstream9—Red Hat
cpe:/o:redhat:enterprise_linux:9::baseos9—Red Hat
cpe:/a:redhat:discovery:1.14::el91.14—Red Hat
cpe:/o:redhat:rhel_els:66—Red Hat
cpe:/o:redhat:rhel_els:77—Red Hat
cpe:/a:redhat:openshift:44—Red Hat
  • cpe:/o:redhat:enterprise_linux:10.0 Versions 10.0 — ·Red Hat
  • cpe:/o:redhat:enterprise_linux:8::baseos Versions 8 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
  • cpe:/o:redhat:enterprise_linux:9::baseos Versions 9 — ·Red Hat
  • cpe:/a:redhat:discovery:1.14::el9 Versions 1.14 — ·Red Hat
  • cpe:/o:redhat:rhel_els:6 Versions 6 — ·Red Hat
  • cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat
  • cpe:/a:redhat:openshift:4 Versions 4 — ·Red Hat

Remediation

Red Hat 3 advisories

  • RHSA-2025:8385 Released 2025-06-02 · Red Hat rating Moderate
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 1.14 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2025:7050 Released 2025-05-13 · Red Hat rating Moderate
    rsync security update
    • Red Hat Enterprise Linux AppStream (v. 9) rsync-daemon-3.2.5-3.el9, rsync-rrsync-3.2.5-3.el9
    • Red Hat Enterprise Linux BaseOS (v. 9) rsync-3.2.5-3.el9
  • RHSA-2025:2600 Released 2025-03-11 · Red Hat rating Moderate
    rsync security update
    • Red Hat Enterprise Linux BaseOS (v. 8) rsync-3.1.3-21.el8_10, rsync-daemon-3.1.3-21.el8_10

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat Discovery 1.14, Red Hat Enterprise Linux 10 and 5 more products — RHBA-2025:6470

    6 records Highest priority Priority CRITICAL 1 CRITICAL, 3 HIGH, 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2024-11208 Rsync: heap buffer overflow in rsync due to improper checksum length handlingPriority CRITICAL 87
    • TI-2024-11209 Rsync: info leak via uninitialized stack contentsPriority HIGH 72
    • TI-2024-11212 Rsync: --safe-links option bypass leads to path traversalPriority HIGH 66
    Show all 6 records → Advisory →
  • Advisory ·

    Red Hat Discovery 1.14, Red Hat Enterprise Linux 10 and 5 more products — RHSA-2025:2600

    3 records Highest priority Priority HIGH 2 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2024-11212 Rsync: --safe-links option bypass leads to path traversalPriority HIGH 66
    • TI-2024-11211 Rsync: path traversal vulnerability in rsyncPriority HIGH 66
    Show all 3 records → Advisory →
Show 1 more group
  • Advisory ·

    Red Hat Discovery 1.14, Red Hat Enterprise Linux 10 and 5 more products — RHSA-2025:7050

    3 records Highest priority Priority HIGH 2 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2024-11212 Rsync: --safe-links option bypass leads to path traversalPriority HIGH 66
    • TI-2024-11211 Rsync: path traversal vulnerability in rsyncPriority HIGH 66
    Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat Discovery 1.14Fixed RHSA-2025:8385
Red Hat Enterprise Linux AppStream (v. 10)Fixed—
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:7050
Red Hat Enterprise Linux BaseOS (v. 10)Fixed—
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2025:2600
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2025:7050
Not affected: 1 product
  • Red Hat Discovery 1.14

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-12747
  2. 2026-10-03 Alias added: GHSA-gp7r-m4cc-qhwq
  3. 2026-10-21 Affected versions changed · CNA
  4. 2026-10-21 Affected versions changed · Red Hat
  5. 2026-10-21 Affected versions changed · CNA
  6. 2026-10-22 Affected versions changed · Red Hat

References

Advisory 4

Other 3

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences