CVE-2024-12087
14.01.2025, 18:15
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.
| Vendor | Product | Version |
|---|---|---|
| samba | rsync | 𝑥 ≤ 3.3.0 |
| almalinux | almalinux | 8.0 |
| almalinux | almalinux | 9.0 |
| almalinux | almalinux | 10.0 |
| archlinux | arch_linux | - |
| gentoo | linux | - |
| nixos | nixos | 𝑥 < 24.11 |
| suse | suse_linux | - |
| tritondatacenter | smartos | 𝑥 < 20250123 |
| redhat | enterprise_linux | 8.0 |
| redhat | enterprise_linux | 9.0 |
| redhat | enterprise_linux_eus | 9.6 |
| redhat | enterprise_linux_for_arm_64 | 8.0_aarch64:_aarch64 |
| redhat | enterprise_linux_for_arm_64 | 9.0_aarch64:_aarch64 |
| redhat | enterprise_linux_for_arm_64_eus | 9.6_aarch64:_aarch64 |
| redhat | enterprise_linux_for_ibm_z_systems | 8.0_s390x:_s390x |
| redhat | enterprise_linux_for_ibm_z_systems | 9.0_s390x:_s390x |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 9.6_s390x:_s390x |
| redhat | enterprise_linux_for_power_little_endian | 8.0_ppc64le:_ppc64le |
| redhat | enterprise_linux_for_power_little_endian | 9.0_ppc64le:_ppc64le |
| redhat | enterprise_linux_for_power_little_endian_eus | 9.6_ppc64le:_ppc64le |
| redhat | enterprise_linux_server_aus | 9.6 |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 9.6_ppc64le:_ppc64le |
| redhat | enterprise_linux_update_services_for_sap_solutions | 9.6 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| rsync |
|
Common Weakness Enumeration
- CWE-35 - Path Traversal: '.../...//'The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
References