CVE-2024-12088: Rsync: --safe-links option bypass leads to path traversal
A flaw was found in rsync. When using the `--safe-links` option, rsync fails to properly verify if a symbolic link destination contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12088?
CVE-2024-12088 is classified as a medium severity path traversal vulnerability in rsync.
How do I fix CVE-2024-12088?
To fix CVE-2024-12088, upgrade rsync to version 3.2.3-4+deb11u3, 3.2.7-1+deb12u2, or 3.3.0+ds1-4.
Who is affected by CVE-2024-12088?
CVE-2024-12088 affects users of rsync versions up to and including 3.2.3-4+deb11u1 and 3.2.7-1.
What type of vulnerability is CVE-2024-12088?
CVE-2024-12088 is a path traversal vulnerability due to improper verification of symbolic link destinations.
Can CVE-2024-12088 lead to data loss?
Yes, CVE-2024-12088 may lead to arbitrary file writes outside the intended directory, potentially resulting in data loss.