Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:2048-1

Опубликовано: 25 мая 2026
Источник: suse-cvrf

Описание

Security update for rsync

This update for rsync fixes the following issues

  • CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
  • CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
  • CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
  • CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
  • CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).

Список пакетов

Image SLES12-SP5-Azure-BYOS
rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-BYOS
rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-On-Demand
rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-SAP-BYOS
rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-SAP-On-Demand
rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-Standard-On-Demand
rsync-3.1.3-3.43.1
Image SLES12-SP5-EC2-BYOS
rsync-3.1.3-3.43.1
Image SLES12-SP5-EC2-ECS-On-Demand
rsync-3.1.3-3.43.1
Image SLES12-SP5-EC2-On-Demand
rsync-3.1.3-3.43.1
Image SLES12-SP5-EC2-SAP-BYOS
rsync-3.1.3-3.43.1
Image SLES12-SP5-EC2-SAP-On-Demand
rsync-3.1.3-3.43.1
Image SLES12-SP5-GCE-BYOS
rsync-3.1.3-3.43.1
Image SLES12-SP5-GCE-On-Demand
rsync-3.1.3-3.43.1
Image SLES12-SP5-GCE-SAP-BYOS
rsync-3.1.3-3.43.1
Image SLES12-SP5-GCE-SAP-On-Demand
rsync-3.1.3-3.43.1
SUSE Linux Enterprise Server 12 SP5-LTSS
rsync-3.1.3-3.43.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
rsync-3.1.3-3.43.1

Ссылки

Описание

A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-On-Demand:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-SAP-BYOS:rsync-3.1.3-3.43.1
Ссылки

Описание

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-On-Demand:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-SAP-BYOS:rsync-3.1.3-3.43.1
Ссылки

Описание

A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-On-Demand:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-SAP-BYOS:rsync-3.1.3-3.43.1
Ссылки

Описание

A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-On-Demand:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-SAP-BYOS:rsync-3.1.3-3.43.1
Ссылки

Описание

A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-On-Demand:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-SAP-BYOS:rsync-3.1.3-3.43.1
Ссылки

Описание

A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-On-Demand:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-SAP-BYOS:rsync-3.1.3-3.43.1
Ссылки

Описание

A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger the issue.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-On-Demand:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-SAP-BYOS:rsync-3.1.3-3.43.1
Ссылки

Описание

Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-On-Demand:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-SAP-BYOS:rsync-3.1.3-3.43.1
Ссылки

Описание

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-On-Demand:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-SAP-BYOS:rsync-3.1.3-3.43.1
Ссылки

Описание

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-On-Demand:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-SAP-BYOS:rsync-3.1.3-3.43.1
Ссылки

Описание

Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-On-Demand:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-SAP-BYOS:rsync-3.1.3-3.43.1
Ссылки

Описание

Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted entry is not the leading dot directory, followed by a transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-On-Demand:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-SAP-BYOS:rsync-3.1.3-3.43.1
Ссылки

Описание

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-BYOS:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-HPC-On-Demand:rsync-3.1.3-3.43.1
Image SLES12-SP5-Azure-SAP-BYOS:rsync-3.1.3-3.43.1
Ссылки