Описание
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.
A command injection vulnerability in rsync allows remote attackers to execute arbitrary commands by supplying shell metacharacters or newlines in unsanitized inputs, such as hostnames or hostspecs. This impacts multiple vectors—including the RSYNC_CONNECT_PROG variable, daemon hooks, rsync-ssl, and remote-shell parsing—executing commands with the privileges of the running process or user.
Отчет
This Important vulnerability in rsync allows for remote command injection due to insufficient sanitization of user-supplied input across multiple code paths. While the attack complexity is high, successful exploitation could lead to arbitrary command execution under the privileges of the rsync process or the invoking user, impacting confidentiality, integrity, and availability. This risk is particularly relevant in environments where rsync is used for remote synchronization with untrusted sources or destinations.
Меры по смягчению последствий
Do not set RSYNC_CONNECT_PROG or pass untrusted hostnames/paths into rsync / rsync-ssl. If rsyncd is required, omit pre-xfer/post-xfer/early exec unless the command ignores client-controlled RSYNC_* values, and restrict TCP/873 to trusted clients
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | rsync | Affected | ||
| Red Hat Enterprise Linux 7 | rsync | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Affected | ||
| Red Hat OpenShift Container Platform 5 | openshift/ose-rhel-coreos-9 | Affected | ||
| Red Hat Enterprise Linux 10 | rsync | Fixed | RHSA-2026:67463 | 14.09.2026 |
| Red Hat Enterprise Linux 8 | rsync | Fixed | RHSA-2026:74095 | 30.09.2026 |
| Red Hat Enterprise Linux 9 | rsync | Fixed | RHSA-2026:67462 | 14.09.2026 |
| Red Hat Enterprise Linux 9 | rsync | Fixed | RHSA-2026:67462 | 14.09.2026 |
| Red Hat OpenShift Container Platform 4.22 | openshift/ose-rhel-coreos | Fixed | RHSA-2026:71446 | 29.09.2026 |
| Red Hat Cost Management On-Premise 1 | costmanagement/costmanagement-ui-rhel10 | Fixed | RHSA-2026:79357 | 08.10.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
8.1 High
CVSS3
Связанные уязвимости
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.
rsync before 3.5.0contains multiple command and argument injection vul ...
Уязвимость утилиты для передачи и синхронизации файлов Rsync, связанная с непринятием мер по нейтрализации специальных элементов, позволяющая нарушителю выполнить произвольные команды
EPSS
8.1 High
CVSS3