Critical Security Update for rsync: Important Vulnerabilities Addressed
Summary
ALSA-2026:74095: Important: rsync security, bug fix, and enhancement update. Affects rsync versions < 3.1.3-28.el8_10. Fixed in 3.1.3-28.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The rsync utility is a widely used tool for copying and synchronizing files both locally and across networks. It is known for its efficiency, as it only transfers the differences between files rather than the entire file, making it a preferred choice for mirroring and backup tasks. However, recent vulnerabilities have been identified that could compromise the security and integrity of systems using rsync, particularly versions prior to 3.5.0.
Vulnerability Detail
The vulnerabilities in rsync include a range of critical issues such as path traversal attacks, arbitrary file deletion, command injection, memory corruption, and denial of service. These vulnerabilities arise from improper handling of symlinks, crafted file entries, and other malicious inputs. Exploiting these vulnerabilities could lead to unauthorized access, data loss, or service disruption, making it imperative for users to address them promptly.
How To Fix
Minimum fixed version
3.1.3-28.el8_10
This is the first release that contains the fix.
sudo dnf update rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the vulnerable features of rsync, such as the --partial-dir and --backup-dir options, until the update is applied. Additionally, ensure that proper permissions are set on files and directories to mitigate unauthorized access.
Conclusion
The vulnerabilities identified in rsync pose significant risks to system security and data integrity. Users are strongly encouraged to update to the latest patched versions to mitigate these risks. By staying informed and proactive, users can ensure the continued safety of their systems.
See every vulnerability recorded for rsync →
FAQ
rsync is a utility for efficiently transferring and synchronizing files across systems, utilizing a delta-transfer algorithm to minimize data transfer.
The vulnerabilities include path traversal, arbitrary file deletion, command injection, and denial of service, among others.
You can check your version of rsync by running 'rsync --version' in the terminal. If it is below 3.1.3-28.el8_10, it is vulnerable.
If an immediate update is not possible, avoid using vulnerable features and ensure strict file permissions to limit exposure.
Vulert monitors open-source vulnerabilities in your software using a manifest file like package-lock.json, providing real-time alerts without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
