NetSight
IP …
medium6.5

CVE-2024-12087

A path traversal vulnerability exists in rsync.

Impact

A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.

Affected products

VendorProductAffected versions
SambaRsync
through 3.3.0
AlmalinuxAlmalinux
Versions 8.0, 9.0, 10.0
ArchlinuxArch Linux
All versions
GentooLinux
All versions
NixosNixos
before 24.11
SuseSuse Linux
All versions
TritondatacenterSmartos
before 20250123
RedhatEnterprise Linux
Versions 8.0, 9.0
RedhatEnterprise Linux Eus
Version 9.6
RedhatEnterprise Linux For Arm 64
Versions 8.0_aarch64, 9.0_aarch64
RedhatEnterprise Linux For Arm 64 Eus
Version 9.6_aarch64
RedhatEnterprise Linux For Ibm Z Systems
Versions 8.0_s390x, 9.0_s390x

Weakness classification

CWE-22

References