Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2025:0991-1

Опубликовано: 24 мар. 2025
Источник: suse-cvrf

Описание

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2024-12747: Fixed race condition in handling symbolic links (bsc#1235475)

  • Broken rsyncd after protocol bump, regression reported (bsc#1237187).

  • Bump protocol version to 32 - make it easier to show server is patched.

Список пакетов

Container suse/sle-micro-rancher/5.2:latest
rsync-3.2.3-150000.4.36.1
SUSE Enterprise Storage 7.1
rsync-3.2.3-150000.4.36.1
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS
rsync-3.2.3-150000.4.36.1
SUSE Linux Enterprise Micro 5.1
rsync-3.2.3-150000.4.36.1
SUSE Linux Enterprise Micro 5.2
rsync-3.2.3-150000.4.36.1
SUSE Linux Enterprise Server 15 SP3-LTSS
rsync-3.2.3-150000.4.36.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3
rsync-3.2.3-150000.4.36.1

Ссылки

Описание

A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.

Затронутые продукты
Container suse/sle-micro-rancher/5.2:latest:rsync-3.2.3-150000.4.36.1
SUSE Enterprise Storage 7.1:rsync-3.2.3-150000.4.36.1
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rsync-3.2.3-150000.4.36.1
SUSE Linux Enterprise Micro 5.1:rsync-3.2.3-150000.4.36.1
Ссылки