CVE-2024-12088: Rsync: --safe-links option bypass leads to path traversal
A flaw was found in rsync. When using the --safe-links option, rsync fails to properly verify if a symbolic link destination contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.
Other sources
A flaw was found in rsync. When using the --safe-links option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.
— Debian
rsync --safe-links options fail to verify whether a symbolic link destination contains another symbolic link with it leading to a path traversal vulnerability
— Red Hat
Rsync: --safe-links option bypass leads to path traversal
— Microsoft
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rsyncto a version that resolves this vulnerability.Fixed in 3.2.3-4+deb11u3Fixed in 3.2.7-1+deb12u2Fixed in 3.3.0+ds1-4
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-12088?
CVE-2024-12088 is classified as a medium severity path traversal vulnerability in rsync.
How do I fix CVE-2024-12088?
To fix CVE-2024-12088, upgrade rsync to version 3.2.3-4+deb11u3, 3.2.7-1+deb12u2, or 3.3.0+ds1-4.
Who is affected by CVE-2024-12088?
CVE-2024-12088 affects users of rsync versions up to and including 3.2.3-4+deb11u1 and 3.2.7-1.
What type of vulnerability is CVE-2024-12088?
CVE-2024-12088 is a path traversal vulnerability due to improper verification of symbolic link destinations.
Can CVE-2024-12088 lead to data loss?
Yes, CVE-2024-12088 may lead to arbitrary file writes outside the intended directory, potentially resulting in data loss.