Description
An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 alpine v3.15 | | =3.0.5-r0 || =3.0.6-r0 || =3.0.6-r1 || =3.0.7-r0 || =3.0.7-r1 || =3.0.8-r0 || =3.0.9-r0 || =3.0.9-r1 || =3.1.0-r0 || =3.1.1-r0 || =3.1.1-r1 || =3.1.1-r2 || =3.1.2-r2 || =3.1.2-r3 || =3.1.2-r4 || =3.1.2-r5 || =3.1.2-r6 || =3.1.2-r7 || =3.1.3-r0 || =3.1.3-r1 || =3.1.3-r2 || =3.1.3-r3 || =3.2.2-r0 || =3.2.3-r0 || =3.2.3-r1 || =3.2.3-r2 || =3.2.3-r3 || =3.2.3-r4 || =3.2.3-r5 || =3.2.3-r6 || >=0 <3.2.4-r0 | 3.2.4-r0 |
alpine v3.13 | | =3.0.5-r0 || =3.0.6-r0 || =3.0.6-r1 || =3.0.7-r0 || =3.0.7-r1 || =3.0.8-r0 || =3.0.9-r0 || =3.0.9-r1 || =3.1.0-r0 || =3.1.1-r0 || =3.1.1-r1 || =3.1.1-r2 || =3.1.2-r2 || =3.1.2-r3 || =3.1.2-r4 || =3.1.2-r5 || =3.1.2-r6 || =3.1.2-r7 || =3.1.3-r0 || =3.1.3-r1 || =3.1.3-r2 || =3.1.3-r3 || =3.2.2-r0 || =3.2.3-r0 || =3.2.3-r1 || =3.2.3-r2 || =3.2.3-r3 || =3.2.3-r4 || =3.2.3-r5 || >=0 <3.2.4-r0 | 3.2.4-r0 |
alpine v3.17 | | =3.0.5-r0 || =3.0.6-r0 || =3.0.6-r1 || =3.0.7-r0 || =3.0.7-r1 || =3.0.8-r0 || =3.0.9-r0 || =3.0.9-r1 || =3.1.0-r0 || =3.1.1-r0 || =3.1.1-r1 || =3.1.1-r2 || =3.1.2-r2 || =3.1.2-r3 || =3.1.2-r4 || =3.1.2-r5 || =3.1.2-r6 || =3.1.2-r7 || =3.1.3-r0 || =3.1.3-r1 || =3.1.3-r2 || =3.1.3-r3 || =3.2.2-r0 || =3.2.3-r0 || =3.2.3-r1 || =3.2.3-r2 || =3.2.3-r3 || =3.2.3-r4 || =3.2.3-r5 || =3.2.4-r0 || =3.2.4-r1 || >=0 <3.2.4-r2 | 3.2.4-r2 |
alpine v3.19 | | =3.0.5-r0 || =3.0.6-r0 || =3.0.6-r1 || =3.0.7-r0 || =3.0.7-r1 || =3.0.8-r0 || =3.0.9-r0 || =3.0.9-r1 || =3.1.0-r0 || =3.1.1-r0 || =3.1.1-r1 || =3.1.1-r2 || =3.1.2-r2 || =3.1.2-r3 || =3.1.2-r4 || =3.1.2-r5 || =3.1.2-r6 || =3.1.2-r7 || =3.1.3-r0 || =3.1.3-r1 || =3.1.3-r2 || =3.1.3-r3 || =3.2.2-r0 || =3.2.3-r0 || =3.2.3-r1 || =3.2.3-r2 || =3.2.3-r3 || =3.2.3-r4 || =3.2.3-r5 || =3.2.4-r0 || =3.2.4-r1 || >=0 <3.2.4-r2 | 3.2.4-r2 |
alpine v3.20 | | =3.0.5-r0 || =3.0.6-r0 || =3.0.6-r1 || =3.0.7-r0 || =3.0.7-r1 || =3.0.8-r0 || =3.0.9-r0 || =3.0.9-r1 || =3.1.0-r0 || =3.1.1-r0 || =3.1.1-r1 || =3.1.1-r2 || =3.1.2-r2 || =3.1.2-r3 || =3.1.2-r4 || =3.1.2-r5 || =3.1.2-r6 || =3.1.2-r7 || =3.1.3-r0 || =3.1.3-r1 || =3.1.3-r2 || =3.1.3-r3 || =3.2.2-r0 || =3.2.3-r0 || =3.2.3-r1 || =3.2.3-r2 || =3.2.3-r3 || =3.2.3-r4 || =3.2.3-r5 || =3.2.4-r0 || =3.2.4-r1 || >=0 <3.2.4-r2 | 3.2.4-r2 |
alpine v3.22 | | =3.0.5-r0 || =3.0.6-r0 || =3.0.6-r1 || =3.0.7-r0 || =3.0.7-r1 || =3.0.8-r0 || =3.0.9-r0 || =3.0.9-r1 || =3.1.0-r0 || =3.1.1-r0 || =3.1.1-r1 || =3.1.1-r2 || =3.1.2-r2 || =3.1.2-r3 || =3.1.2-r4 || =3.1.2-r5 || =3.1.2-r6 || =3.1.2-r7 || =3.1.3-r0 || =3.1.3-r1 || =3.1.3-r2 || =3.1.3-r3 || =3.2.2-r0 || =3.2.3-r0 || =3.2.3-r1 || =3.2.3-r2 || =3.2.3-r3 || =3.2.3-r4 || =3.2.3-r5 || =3.2.4-r0 || =3.2.4-r1 || >=0 <3.2.4-r2 | 3.2.4-r2 |
 debian 12 | | | 3.2.5-1 |
debian 13 | | | 3.2.5-1 |
alpine v3.14 | | =3.0.5-r0 || =3.0.6-r0 || =3.0.6-r1 || =3.0.7-r0 || =3.0.7-r1 || =3.0.8-r0 || =3.0.9-r0 || =3.0.9-r1 || =3.1.0-r0 || =3.1.1-r0 || =3.1.1-r1 || =3.1.1-r2 || =3.1.2-r2 || =3.1.2-r3 || =3.1.2-r4 || =3.1.2-r5 || =3.1.2-r6 || =3.1.2-r7 || =3.1.3-r0 || =3.1.3-r1 || =3.1.3-r2 || =3.1.3-r3 || =3.2.2-r0 || =3.2.3-r0 || =3.2.3-r1 || =3.2.3-r2 || =3.2.3-r3 || =3.2.3-r4 || =3.2.3-r5 || >=0 <3.2.4-r0 | 3.2.4-r0 |
alpine v3.16 | | =3.0.5-r0 || =3.0.6-r0 || =3.0.6-r1 || =3.0.7-r0 || =3.0.7-r1 || =3.0.8-r0 || =3.0.9-r0 || =3.0.9-r1 || =3.1.0-r0 || =3.1.1-r0 || =3.1.1-r1 || =3.1.1-r2 || =3.1.2-r2 || =3.1.2-r3 || =3.1.2-r4 || =3.1.2-r5 || =3.1.2-r6 || =3.1.2-r7 || =3.1.3-r0 || =3.1.3-r1 || =3.1.3-r2 || =3.1.3-r3 || =3.2.2-r0 || =3.2.3-r0 || =3.2.3-r1 || =3.2.3-r2 || =3.2.3-r3 || =3.2.3-r4 || =3.2.3-r5 || =3.2.4-r0 || =3.2.4-r1 || >=0 <3.2.4-r2 | 3.2.4-r2 |
