CVE-2024-12085

Опубликовано: 14 янв. 2025

Источник: nvd

CVSS3: 7.5

EPSS Средний

Описание

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.

Ссылки

https://access.redhat.com/errata/RHSA-2025:0324
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:0325
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:0637
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:0688
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:0714
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:0774
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:0787
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:0790
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:0849
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:0884
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:0885
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:1120
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:1123
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:1128
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:1225
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:1227
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:1242
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:1451
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:2701
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2024-12085
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*

Версия до 3.3.0 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:redhat:openshift:5.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform:4.13:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform:4.14:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform:4.15:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform:4.16:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform:4.17:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.2_aarch64:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.8_aarch64:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.6_aarch64:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.2_s390x:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8_s390x:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.8_ppc64le:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.2_ppc64le:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:9.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.4_ppc64le:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6_ppc64le:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.8_ppc64le:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.0_ppc64le:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.2_ppc64le:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.4_ppc64le:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.6_ppc64le:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:8.8:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.6:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:almalinux:almalinux:8.0:-:*:*:*:*:*:*

cpe:2.3:o:almalinux:almalinux:9.0:-:*:*:*:*:*:*

cpe:2.3:o:almalinux:almalinux:10.0:-:*:*:*:*:*:*

Конфигурация 4

cpe:2.3:o:archlinux:arch_linux:-:*:*:*:*:*:*:*

Конфигурация 5

cpe:2.3:o:gentoo:linux:-:*:*:*:*:*:*:*

Конфигурация 6

cpe:2.3:o:nixos:nixos:*:*:*:*:*:*:*:*

Версия до 24.11 (исключая)

Конфигурация 7

cpe:2.3:o:suse:suse_linux:-:*:*:*:*:*:*:*

Конфигурация 8

cpe:2.3:o:tritondatacenter:smartos:*:*:*:*:*:*:*:*

Версия до 20250123 (исключая)

EPSS

Процентиль: 93%

0.11376

Средний

7.5 High

CVSS3

Дефекты

CWE-908

Связанные уязвимости

CVE-2024-12085

CVSS3: 7.5

ubuntu

10 месяцев назад

CVE-2024-12085

CVSS3: 7.5

redhat

10 месяцев назад

CVE-2024-12085

CVSS3: 7.5

msrc

10 месяцев назад

Rsync: info leak via uninitialized stack contents

CVE-2024-12085

CVSS3: 7.5

debian

10 месяцев назад

A flaw was found in rsync which could be triggered when rsync compares ...

RLSA-2025:0325

rocky

10 месяцев назад

Important: rsync security update

EPSS

Процентиль: 93%

0.11376

Средний

7.5 High

CVSS3

Дефекты

CWE-908