Loading vulnerability…
Rsync --safe-links Symlink Path Traversal
CVE-2024-12088 is a path traversal vulnerability in the rsync client’s handling of symbolic links when the --safe-links option is used. The client does not properly verify whether a symbolic-link destination supplied by the server contains a further symbolic link. A malicious server can use this nested-link condition to cause writes outside the intended destination directory.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation may allow arbitrary files to be written outside the intended directory. Such writes can enable unauthorized modification of files accessible to the affected rsync client process.
If you can’t patch tonight, do this now.
Until a patched rsync version can be installed, do not use --safe-links when synchronizing with untrusted or potentially compromised rsync servers. Restrict rsync connections to trusted servers and accounts.
Patch, then assume compromise.
Update rsync to a vendor-provided patched release. Upstream rsync 3.4.0 and later contain fixes for this vulnerability; rsync 3.4.1 also includes the fix. Install patched distribution packages where rsync is supplied by an operating-system vendor.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.