SB2025031774 - Red Hat Enterprise Linux 8 update for rsync

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025031774

SB2025031774 - Red Hat Enterprise Linux 8 update for rsync

Published: March 17, 2025

Security Bulletin ID SB2025031774
Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Path traversal (CVE-ID: CVE-2024-12087)

The vulnerability allows a remote server to write files to arbitrary locations on the system.

The vulnerability exists due to input validation error when using "--inc-recursive" option. A remote attacker can can trick the victim into connecting to a rouge rsync server and write arbitrary files to arbitrary locations on the client system.


2) Path traversal (CVE-ID: CVE-2024-12088)

The vulnerability allows a remote server to write files to arbitrary locations on the system.

The vulnerability exists due to input validation error when using "--safe-links" option. A remote attacker can can trick the victim into connecting to a rouge rsync server and write arbitrary files to arbitrary locations on the client system.

3) Race condition (CVE-ID: CVE-2024-12747)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a race condition when handling symbolic links. A local user can replace a file with a symbolic link, bypass implemented protection in rsync that prevents software from following symbolic links and read contents of arbitrary files on the system with elevated privileges.


Remediation

Install update from vendor's website.

References