rhsa-2025:2600
Vulnerability from csaf_redhat
Published
2025-03-11 00:23
Modified
2025-03-15 01:02
Summary
Red Hat Security Advisory: rsync security update

Notes

Topic
An update for rsync is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es): * rsync: Path traversal vulnerability in rsync (CVE-2024-12087) * rsync: --safe-links option bypass leads to path traversal (CVE-2024-12088) * rsync: Race Condition in rsync Handling Symbolic Links (CVE-2024-12747) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "An update for rsync is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: Path traversal vulnerability in rsync (CVE-2024-12087)\n\n* rsync: --safe-links option bypass leads to path traversal (CVE-2024-12088)\n\n* rsync: Race Condition in rsync Handling Symbolic Links (CVE-2024-12747)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2025:2600",
            url: "https://access.redhat.com/errata/RHSA-2025:2600",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#moderate",
            url: "https://access.redhat.com/security/updates/classification/#moderate",
         },
         {
            category: "external",
            summary: "2330672",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2330672",
         },
         {
            category: "external",
            summary: "2330676",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2330676",
         },
         {
            category: "external",
            summary: "2332968",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2332968",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2600.json",
         },
      ],
      title: "Red Hat Security Advisory: rsync security update",
      tracking: {
         current_release_date: "2025-03-15T01:02:21+00:00",
         generator: {
            date: "2025-03-15T01:02:21+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.4.1",
            },
         },
         id: "RHSA-2025:2600",
         initial_release_date: "2025-03-11T00:23:51+00:00",
         revision_history: [
            {
               date: "2025-03-11T00:23:51+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2025-03-11T00:23:51+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2025-03-15T01:02:21+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux BaseOS (v. 8)",
                        product: {
                           name: "Red Hat Enterprise Linux BaseOS (v. 8)",
                           product_id: "BaseOS-8.10.0.Z.MAIN.EUS",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:8::baseos",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Enterprise Linux",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "rsync-0:3.1.3-21.el8_10.src",
                        product: {
                           name: "rsync-0:3.1.3-21.el8_10.src",
                           product_id: "rsync-0:3.1.3-21.el8_10.src",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rsync@3.1.3-21.el8_10?arch=src",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "src",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "rsync-0:3.1.3-21.el8_10.aarch64",
                        product: {
                           name: "rsync-0:3.1.3-21.el8_10.aarch64",
                           product_id: "rsync-0:3.1.3-21.el8_10.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rsync@3.1.3-21.el8_10?arch=aarch64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
                        product: {
                           name: "rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
                           product_id: "rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rsync-debugsource@3.1.3-21.el8_10?arch=aarch64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
                        product: {
                           name: "rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
                           product_id: "rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rsync-debuginfo@3.1.3-21.el8_10?arch=aarch64",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "rsync-0:3.1.3-21.el8_10.ppc64le",
                        product: {
                           name: "rsync-0:3.1.3-21.el8_10.ppc64le",
                           product_id: "rsync-0:3.1.3-21.el8_10.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rsync@3.1.3-21.el8_10?arch=ppc64le",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
                        product: {
                           name: "rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
                           product_id: "rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rsync-debugsource@3.1.3-21.el8_10?arch=ppc64le",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
                        product: {
                           name: "rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
                           product_id: "rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rsync-debuginfo@3.1.3-21.el8_10?arch=ppc64le",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "rsync-0:3.1.3-21.el8_10.x86_64",
                        product: {
                           name: "rsync-0:3.1.3-21.el8_10.x86_64",
                           product_id: "rsync-0:3.1.3-21.el8_10.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rsync@3.1.3-21.el8_10?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
                        product: {
                           name: "rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
                           product_id: "rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rsync-debugsource@3.1.3-21.el8_10?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
                        product: {
                           name: "rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
                           product_id: "rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rsync-debuginfo@3.1.3-21.el8_10?arch=x86_64",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "rsync-0:3.1.3-21.el8_10.s390x",
                        product: {
                           name: "rsync-0:3.1.3-21.el8_10.s390x",
                           product_id: "rsync-0:3.1.3-21.el8_10.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rsync@3.1.3-21.el8_10?arch=s390x",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rsync-debugsource-0:3.1.3-21.el8_10.s390x",
                        product: {
                           name: "rsync-debugsource-0:3.1.3-21.el8_10.s390x",
                           product_id: "rsync-debugsource-0:3.1.3-21.el8_10.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rsync-debugsource@3.1.3-21.el8_10?arch=s390x",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
                        product: {
                           name: "rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
                           product_id: "rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rsync-debuginfo@3.1.3-21.el8_10?arch=s390x",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "rsync-daemon-0:3.1.3-21.el8_10.noarch",
                        product: {
                           name: "rsync-daemon-0:3.1.3-21.el8_10.noarch",
                           product_id: "rsync-daemon-0:3.1.3-21.el8_10.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rsync-daemon@3.1.3-21.el8_10?arch=noarch",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "rsync-0:3.1.3-21.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
               product_id: "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
            },
            product_reference: "rsync-0:3.1.3-21.el8_10.aarch64",
            relates_to_product_reference: "BaseOS-8.10.0.Z.MAIN.EUS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rsync-0:3.1.3-21.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
               product_id: "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
            },
            product_reference: "rsync-0:3.1.3-21.el8_10.ppc64le",
            relates_to_product_reference: "BaseOS-8.10.0.Z.MAIN.EUS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rsync-0:3.1.3-21.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
               product_id: "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
            },
            product_reference: "rsync-0:3.1.3-21.el8_10.s390x",
            relates_to_product_reference: "BaseOS-8.10.0.Z.MAIN.EUS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rsync-0:3.1.3-21.el8_10.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
               product_id: "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
            },
            product_reference: "rsync-0:3.1.3-21.el8_10.src",
            relates_to_product_reference: "BaseOS-8.10.0.Z.MAIN.EUS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rsync-0:3.1.3-21.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
               product_id: "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
            },
            product_reference: "rsync-0:3.1.3-21.el8_10.x86_64",
            relates_to_product_reference: "BaseOS-8.10.0.Z.MAIN.EUS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rsync-daemon-0:3.1.3-21.el8_10.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
               product_id: "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
            },
            product_reference: "rsync-daemon-0:3.1.3-21.el8_10.noarch",
            relates_to_product_reference: "BaseOS-8.10.0.Z.MAIN.EUS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rsync-debuginfo-0:3.1.3-21.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
               product_id: "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
            },
            product_reference: "rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
            relates_to_product_reference: "BaseOS-8.10.0.Z.MAIN.EUS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
               product_id: "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
            },
            product_reference: "rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
            relates_to_product_reference: "BaseOS-8.10.0.Z.MAIN.EUS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rsync-debuginfo-0:3.1.3-21.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
               product_id: "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
            },
            product_reference: "rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
            relates_to_product_reference: "BaseOS-8.10.0.Z.MAIN.EUS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rsync-debuginfo-0:3.1.3-21.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
               product_id: "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
            },
            product_reference: "rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
            relates_to_product_reference: "BaseOS-8.10.0.Z.MAIN.EUS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rsync-debugsource-0:3.1.3-21.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
               product_id: "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
            },
            product_reference: "rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
            relates_to_product_reference: "BaseOS-8.10.0.Z.MAIN.EUS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rsync-debugsource-0:3.1.3-21.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
               product_id: "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
            },
            product_reference: "rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
            relates_to_product_reference: "BaseOS-8.10.0.Z.MAIN.EUS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rsync-debugsource-0:3.1.3-21.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
               product_id: "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
            },
            product_reference: "rsync-debugsource-0:3.1.3-21.el8_10.s390x",
            relates_to_product_reference: "BaseOS-8.10.0.Z.MAIN.EUS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rsync-debugsource-0:3.1.3-21.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
               product_id: "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
            },
            product_reference: "rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
            relates_to_product_reference: "BaseOS-8.10.0.Z.MAIN.EUS",
         },
      ],
   },
   vulnerabilities: [
      {
         acknowledgments: [
            {
               names: [
                  "Simon Scannell",
                  "Pedro Gallegos",
                  "Jasiel Spelman",
               ],
               organization: "Google",
            },
         ],
         cve: "CVE-2024-12087",
         cwe: {
            id: "CWE-35",
            name: "Path Traversal: '.../...//'",
         },
         discovery_date: "2024-12-05T21:23:24.139000+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2330672",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "rsync: Path traversal vulnerability in rsync",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat rates this flaw to have moderate severity as it depends on specific configurations for the attack to succeed, symbolic link syncing must be  enabled (explicitly by providing the `--links` option or implicitly such as with `--archive`) and the client must connect to a malicious or compromised server.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2024-12087",
            },
            {
               category: "external",
               summary: "RHBZ#2330672",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2330672",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2024-12087",
               url: "https://www.cve.org/CVERecord?id=CVE-2024-12087",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2024-12087",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2024-12087",
            },
            {
               category: "external",
               summary: "https://kb.cert.org/vuls/id/952657",
               url: "https://kb.cert.org/vuls/id/952657",
            },
         ],
         release_date: "2025-01-14T15:06:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2025-03-11T00:23:51+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2025:2600",
            },
            {
               category: "workaround",
               details: "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
               product_ids: [
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "rsync: Path traversal vulnerability in rsync",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Simon Scannell",
                  "Jasiel Spelman",
                  "Pedro Gallegos",
               ],
               organization: "Google",
            },
         ],
         cve: "CVE-2024-12088",
         cwe: {
            id: "CWE-35",
            name: "Path Traversal: '.../...//'",
         },
         discovery_date: "2024-12-05T21:55:22.700000+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2330676",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "rsync: --safe-links option bypass leads to path traversal",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2024-12088",
            },
            {
               category: "external",
               summary: "RHBZ#2330676",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2330676",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2024-12088",
               url: "https://www.cve.org/CVERecord?id=CVE-2024-12088",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2024-12088",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2024-12088",
            },
            {
               category: "external",
               summary: "https://kb.cert.org/vuls/id/952657",
               url: "https://kb.cert.org/vuls/id/952657",
            },
         ],
         release_date: "2025-01-14T15:06:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2025-03-11T00:23:51+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2025:2600",
            },
            {
               category: "workaround",
               details: "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
               product_ids: [
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "rsync: --safe-links option bypass leads to path traversal",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Aleksei Gorban \"loqpa\"",
               ],
            },
         ],
         cve: "CVE-2024-12747",
         cwe: {
            id: "CWE-362",
            name: "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')",
         },
         discovery_date: "2024-12-18T07:12:52.493000+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2332968",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "rsync: Race Condition in rsync Handling Symbolic Links",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
               "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2024-12747",
            },
            {
               category: "external",
               summary: "RHBZ#2332968",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2332968",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2024-12747",
               url: "https://www.cve.org/CVERecord?id=CVE-2024-12747",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2024-12747",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2024-12747",
            },
            {
               category: "external",
               summary: "https://kb.cert.org/vuls/id/952657",
               url: "https://kb.cert.org/vuls/id/952657",
            },
         ],
         release_date: "2025-01-14T15:06:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2025-03-11T00:23:51+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2025:2600",
            },
            {
               category: "workaround",
               details: "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
               product_ids: [
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 5.6,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.src",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-0:3.1.3-21.el8_10.x86_64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-daemon-0:3.1.3-21.el8_10.noarch",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debuginfo-0:3.1.3-21.el8_10.x86_64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.aarch64",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.ppc64le",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.s390x",
                  "BaseOS-8.10.0.Z.MAIN.EUS:rsync-debugsource-0:3.1.3-21.el8_10.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "rsync: Race Condition in rsync Handling Symbolic Links",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.