Description (CNA)
rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| RsyncProject / rsync | affected 3.4.2 through 3.4.4; unaffected 3.5.0 |
CWE
CWE-770
References
- https://github.com/RsyncProject/rsync/security/advisories/GHSA-rjvj-qgqg-cvx9
- https://github.com/RsyncProject/rsync/releases/tag/v3.5.0
- https://www.vulncheck.com/advisories/rsync-dos-via-zt-zstandard-compression-thread-exhaustion
ADP enrichment
No English description supplied.
No references supplied.