Loading vulnerability…
Arbitrary Client File Disclosure in Rsync
CVE-2024-12086 is an information-disclosure vulnerability in rsync versions through 3.3.0. During a client-to-server file transfer, a malicious rsync server can supply specially constructed checksum values for arbitrary client-side files. By observing the client’s checksum-comparison responses, the server can enumerate and reconstruct the contents of those files byte by byte.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A malicious rsync server can obtain unauthorized access to arbitrary files readable by the connecting client. This can disclose sensitive client-side data; no integrity modification or availability impact is described for this vulnerability.
If you can’t patch tonight, do this now.
No acceptable workaround is identified. Until patched packages can be deployed, avoid connecting clients to untrusted rsync servers and restrict use of rsync client-to-server transfers to trusted, authenticated server endpoints.
Patch, then assume compromise.
Upgrade rsync to version 3.4.0 or later, or install the patched rsync package supplied by the operating-system or product vendor. For affected RHEL 9.6 deployments, Red Hat provides rsync-3.2.5-3.el9_6.1 packages.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.