Critical Security Flaws in rsync: Important Update Required
Summary
RLSA-2026:74095: Important: rsync security, bug fix, and enhancement update. Affects rsync versions < 0:3.1.3-28.el8_10. Fixed in 0:3.1.3-28.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rsync utility is a widely used tool that enables users to efficiently copy and synchronize files both locally and across networks. Its primary advantage lies in its ability to transfer only the differences between files, making it a fast and effective solution for file synchronization and mirroring. However, recent vulnerabilities have been identified in rsync versions prior to 3.5.0, exposing users to various security risks.
Vulnerability Detail
The vulnerabilities in rsync stem from multiple issues, including path traversal, arbitrary file deletion, command injection, memory corruption, and denial of service. These vulnerabilities can lead to unauthorized file access, local privilege escalation, and even arbitrary file writes. The root causes include improper handling of symlinks, flawed authorization checks, and insufficient input validation, which can be exploited by malicious actors to compromise system integrity and confidentiality.
How To Fix
Minimum fixed version
0:3.1.3-28.el8_10
This is the first release that contains the fix.
sudo dnf update rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the vulnerable features of rsync, such as the --partial-dir and --backup-dir options, until the package is updated. Additionally, ensure that proper file permissions and access controls are in place to limit exposure to potential exploitation.
Conclusion
In summary, the recent vulnerabilities discovered in rsync pose significant risks to users, necessitating immediate action to update the software to the latest patched version. By following the recommended steps and utilizing available tools like Vulert, users can safeguard their systems against potential exploitation.
See every vulnerability recorded for rsync →
FAQ
The CVSS score for the vulnerabilities in rsync is 8.2, indicating a high level of risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
The main vulnerabilities include path traversal, arbitrary file deletion, command injection, and denial of service, among others.
Yes, Vulert can monitor and alert in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If immediate updates are not possible, avoid using vulnerable features and ensure strict file permissions to minimize risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
