Vulnerabilities

TI-2024-11208 CVE-2024-12084 · GHSA-85h7-m8c3-v9wc

Rsync: heap buffer overflow in rsync due to improper checksum length handling

CRITICAL 87

A heap-based buffer overflow flaw was found in the rsync daemon.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.72514 Published 2025-01-15 Fixed in 3.4.1-2.el10 CWE-122

TI-2024-11211 CVE-2024-12087 · GHSA-9x68-7qq6-v523

Rsync: path traversal vulnerability in rsync

HIGH 66

A path traversal vulnerability exists in rsync.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02259 Published 2025-01-14 Partial fix · 3.4.1-2.el10, 3.0.6-12.el6_10.2 +11 CWE-22

TI-2024-11212 CVE-2024-12088 · GHSA-ffph-g3pc-8r3g

Rsync: --safe-links option bypass leads to path traversal

HIGH 66

A flaw was found in rsync.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04646 Published 2025-01-14 Partial fix · 3.4.1-2.el10, 3.1.3-21.el8_10 +2 CWE-22

TI-2024-11210 CVE-2024-12086 · GHSA-82c6-8mfc-c23h

Rsync: rsync server leaks arbitrary client files

MEDIUM 63

A flaw was found in rsync.

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.01789 Published 2025-01-14 Partial fix · 3.4.1-2.el10, 3.2.5-7.el9_8 +2 CWE-390

TI-2024-11209 CVE-2024-12085 · GHSA-xh5q-pch5-g3xq

Rsync: info leak via uninitialized stack contents

HIGH 72

A flaw was found in rsync which could be triggered when rsync compares file checksums.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.08641 Published 2025-01-14 Fixed in 3.4.1-2.el10, 3.0.6-12.el6_10.1 +209 CWE-908

TI-2020-04347 CVE-2020-5291

Privilege escalation in setuid mode via user namespaces in Bubblewrap

LOW 36

Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the `bwrap --userns2` option can be used to make the setuid process keep running as root whi…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00904 Published 2020-03-31 Fixed in 0.4.1 CWE-648