Rsync: rsync server leaks arbitrary client files
A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client.
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-12084US | — | Exploit | ||
A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIG… | ||||
| CVE-2024-12088US | high7.5 | — | ||
A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symb… | ||||
| CVE-2024-12087US | high7.5 | — | ||
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled… | ||||
| CVE-2024-12085US | — | Exploit | ||
A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparis… | ||||
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/downloads/content/package-browser/WEB
- https://access.redhat.com/errata/RHBA-2025:6470ADVISORY
- https://access.redhat.com/errata/RHSA-2026:19368ADVISORY
- https://access.redhat.com/errata/RHSA-2026:20603ADVISORY
- https://access.redhat.com/errata/RHSA-2026:29197ADVISORY
- https://access.redhat.com/security/cve/CVE-2024-12086ADVISORY
- https://bugzilla.redhat.com/show_bug.cgi?id=2330577REPORT
- https://catalog.redhat.com/software/containers/WEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan