Moderate Security Update for rsync: Addressing Path Traversal Vulnerabilities
Summary
ALSA-2025:2600: Moderate: rsync security update. Affects rsync versions < 3.1.3-21.el8_10. Fixed in 3.1.3-21.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The rsync utility is a widely used tool for copying and synchronizing files both locally and across networks. Its efficiency stems from its ability to transfer only the differences between files, rather than the entire file, making it a preferred choice for mirroring and backup tasks. However, recent vulnerabilities have been identified that could compromise the security of file transfers using rsync.
Vulnerability Detail
The vulnerabilities in rsync include a path traversal vulnerability (CVE-2024-12087) that allows attackers to manipulate file paths, potentially leading to unauthorized file access. Additionally, a bypass of the --safe-links option (CVE-2024-12088) can also lead to path traversal issues. Furthermore, a race condition in handling symbolic links (CVE-2024-12747) can be exploited, causing unpredictable behavior during file synchronization. These vulnerabilities could allow attackers to access sensitive files or disrupt file transfer processes.
How To Fix
Minimum fixed version
3.1.3-21.el8_10
This is the first release that contains the fix.
sudo dnf update rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the --safe-links option until the package is updated. Additionally, ensure that file paths are validated and sanitized before processing to mitigate the risk of path traversal attacks.
Conclusion
In summary, the identified vulnerabilities in rsync pose significant risks to file transfer security. It is crucial for users to update to the patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for rsync →
FAQ
rsync is a utility for efficiently transferring and synchronizing files between a local and a remote system.
The main vulnerabilities include path traversal issues and a race condition in handling symbolic links.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
If you cannot update immediately, avoid using the --safe-links option and validate file paths to reduce risk.
More information can be found on the CVE pages for CVE-2024-12087, CVE-2024-12088, and CVE-2024-12747.
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
