Moderate: rsync security and bug fix update
Summary
ALSA-2022:8291: Moderate: rsync security and bug fix update. Affects rsync versions < 3.2.3-18.el9. Fixed in 3.2.3-18.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rsync utility is a powerful tool used for file synchronization and mirroring. It allows users to copy and synchronize files locally or across a network, sending only the differences in files instead of the entire files. This makes synchronization with rsync fast and efficient. The utility is widely used and trusted for its reliability and performance.
Vulnerability Detail
The rsync utility has been found to have a moderate security vulnerability. The vulnerability, identified as CVE-2022-37434, is related to a heap-based buffer over-read and overflow in the zlib library's inflate() function. This vulnerability can be exploited through a large gzip header extra field. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial of service.
How To Fix
Minimum fixed version
3.2.3-18.el9
This is the first release that contains the fix.
sudo dnf update rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the security update as soon as possible to mitigate the risk.
Conclusion
In conclusion, the rsync utility has been found to have a moderate security vulnerability related to a heap-based buffer over-read and overflow. It is recommended to update the rsync package to version 3.2.3-18.el9 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for rsync →
FAQ
Rsync is a utility used for file synchronization and mirroring. It allows users to efficiently copy and synchronize files locally or across a network.
This vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial of service.
To fix this vulnerability, update the rsync package to version 3.2.3-18.el9 or later.
There is no known workaround for this vulnerability. It is recommended to apply the security update.
More information about this vulnerability can be found in the CVE page listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
