CVE-2024-12087
CVE-2024-12087 · Rsync: path traversal vulnerability in rsync
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.
CVSS 6.5 · Medium · EPSS 2.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
red hat enterprise linux 10
- Versions
- ≥ 0:3.4.1-2.el10: Not affected (rpm)
No fix published
red hat enterprise linux 6 extended lifecycle support - extension
- Versions
- ≥ 0:3.0.6-12.el6_10.2: Not affected (rpm)
No fix published
red hat enterprise linux 7 extended lifecycle support
- Versions
- ≥ 0:3.1.2-12.el7_9.2: Not affected (rpm)
No fix published
red hat enterprise linux 8
- Versions
- ≥ 0:3.1.3-21.el8_10: Not affected (rpm)
No fix published
red hat enterprise linux 8.2 advanced update support
- Versions
- ≥ 0:3.1.3-7.el8_2.6: Not affected (rpm)
No fix published
red hat enterprise linux 8.4 advanced mission critical update support
- Versions
- ≥ 0:3.1.3-12.el8_4.6: Not affected (rpm)
No fix published
red hat enterprise linux 8.4 extended update support long-life add-on
- Versions
- ≥ 0:3.1.3-12.el8_4.6: Not affected (rpm)
No fix published
red hat enterprise linux 8.6 advanced mission critical update support
- Versions
- ≥ 0:3.1.3-14.el8_6.9: Not affected (rpm)
No fix published
red hat enterprise linux 8.6 telecommunications update service
- Versions
- ≥ 0:3.1.3-14.el8_6.9: Not affected (rpm)
No fix published
red hat enterprise linux 8.6 update services for sap solutions
- Versions
- ≥ 0:3.1.3-14.el8_6.9: Not affected (rpm)
No fix published
red hat enterprise linux 8.8 telecommunications update service
- Versions
- ≥ 0:3.1.3-20.el8_8.4: Not affected (rpm)
No fix published
red hat enterprise linux 8.8 update services for sap solutions
- Versions
- ≥ 0:3.1.3-20.el8_8.4: Not affected (rpm)
No fix published
red hat enterprise linux 9
- Versions
- ≥ 0:3.2.5-3.el9: Not affected (rpm)
No fix published
red hat enterprise linux 9.0 update services for sap solutions
- Versions
- ≥ 0:3.2.3-9.el9_0.4: Not affected (rpm)
No fix published
red hat enterprise linux 9.2 update services for sap solutions
- Versions
- ≥ 0:3.2.3-19.el9_2.2: Not affected (rpm)
No fix published
red hat enterprise linux 9.4 extended update support
- Versions
- ≥ 0:3.2.3-19.el9_4.2: Not affected (rpm)
No fix published
red hat discovery 1.14
- Versions
- ≥ 1.14.2-1748467619: Not affected (rpm)
No fix published
red hat openshift container platform 4
No fix published
rsync Debian:12
- Versions
- 3.2.7-1
- Affected ranges
- ECOSYSTEM: < 3.2.7-1+deb12u1
Update to 3.2.7-1+deb12u1
rsync Debian:13
- Affected ranges
- ECOSYSTEM: < 3.3.0+ds1-3
Update to 3.3.0+ds1-3
rsync Debian:14
- Affected ranges
- ECOSYSTEM: < 3.3.0+ds1-3
Update to 3.3.0+ds1-3
rsync Ubuntu:Pro:14.04:LTS
- Versions
- 3.0.9-4ubuntu1
- 3.1.0-2
- 3.1.0-2ubuntu0.1
- 3.1.0-2ubuntu0.2
- 3.1.0-2ubuntu0.3
- 3.1.0-2ubuntu0.4
- Affected ranges
- ECOSYSTEM: < 3.1.0-2ubuntu0.4+esm1
Update to 3.1.0-2ubuntu0.4+esm1
rsync Ubuntu:Pro:16.04:LTS
- Versions
- 3.1.1-3
- 3.1.1-3ubuntu1
- 3.1.1-3ubuntu1.1
- 3.1.1-3ubuntu1.2
- 3.1.1-3ubuntu1.3
- 3.1.1-3ubuntu1.3+esm1
- 3.1.1-3ubuntu1.3+esm2
- Affected ranges
- ECOSYSTEM: < 3.1.1-3ubuntu1.3+esm3
Update to 3.1.1-3ubuntu1.3+esm3
rsync Ubuntu:Pro:18.04:LTS
- Versions
- 3.1.2-2
- 3.1.2-2.1
- 3.1.2-2.1ubuntu1
- 3.1.2-2.1ubuntu1.1
- 3.1.2-2.1ubuntu1.2
- 3.1.2-2.1ubuntu1.3
- 3.1.2-2.1ubuntu1.4
- 3.1.2-2.1ubuntu1.5
- 3.1.2-2.1ubuntu1.6
- Affected ranges
- ECOSYSTEM: < 3.1.2-2.1ubuntu1.6+esm1
Update to 3.1.2-2.1ubuntu1.6+esm1
Original sources
- https://access.redhat.com/errata/RHBA-2025:6470
- https://access.redhat.com/errata/RHSA-2025:23154
- https://access.redhat.com/errata/RHSA-2025:23235
- https://access.redhat.com/errata/RHSA-2025:23407
- https://access.redhat.com/errata/RHSA-2025:23415
- https://access.redhat.com/errata/RHSA-2025:23416
- https://access.redhat.com/errata/RHSA-2025:23842
- https://access.redhat.com/errata/RHSA-2025:23853
- https://access.redhat.com/errata/RHSA-2025:23854
- https://access.redhat.com/errata/RHSA-2025:23858
- https://access.redhat.com/errata/RHSA-2025:2600
- https://access.redhat.com/errata/RHSA-2025:7050
- https://access.redhat.com/errata/RHSA-2025:8385
- https://access.redhat.com/security/cve/CVE-2024-12087
- https://bugzilla.redhat.com/show_bug.cgi?id=2330672
- https://kb.cert.org/vuls/id/952657
- https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj
- https://security.netapp.com/advisory/ntap-20250131-0002/
- https://lists.debian.org/debian-lts-announce/2025/01/msg00008.html
- https://www.kb.cert.org/vuls/id/952657
- https://nvd.nist.gov/vuln/detail/CVE-2024-12087