Description (CNA)
A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Not supplied / Not supplied | affected 0 through 3.3.0 |
| Red Hat / Red Hat Enterprise Linux 10 | unaffected 0:3.4.1-2.el10 before * |
| Red Hat / Red Hat Enterprise Linux 8 | unaffected 0:3.1.3-21.el8_10 before * |
| Red Hat / Red Hat Enterprise Linux 9 | unaffected 0:3.2.5-3.el9 before * |
| Red Hat / Red Hat Enterprise Linux 9 | unaffected 0:3.2.5-3.el9 before * |
| Red Hat / Red Hat Discovery 1.14 | unaffected 1.14.2-1748467619 before * |
| Red Hat / Red Hat Enterprise Linux 6 | unknown |
| Red Hat / Red Hat Enterprise Linux 7 | unknown |
| Red Hat / Red Hat OpenShift Container Platform 4 | affected |
CWE
CWE-22
References
- https://access.redhat.com/errata/RHBA-2025:6470
- https://access.redhat.com/errata/RHSA-2025:2600
- https://access.redhat.com/errata/RHSA-2025:7050
- https://access.redhat.com/errata/RHSA-2025:8385
- https://access.redhat.com/security/cve/CVE-2024-12088
- https://bugzilla.redhat.com/show_bug.cgi?id=2330676
- https://kb.cert.org/vuls/id/952657
ADP enrichment
No English description supplied.
No English description supplied.