CVE-2024-12087: Rsync: path traversal vulnerability in rsync

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• github.com/RsyncProject/rsync rsync

  • up to and including 3.3.0affected · semver

• Red Hat Red Hat Discovery 1.14

  • 1.14.2-1748467619 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 10

  • 0:3.4.1-2.el10 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION

  • 0:3.0.6-12.el6_10.2 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support

  • 0:3.1.2-12.el7_9.2 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8

  • 0:3.1.3-21.el8_10 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support

  • 0:3.1.3-7.el8_2.6 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

  • 0:3.1.3-12.el8_4.6 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

  • 0:3.1.3-12.el8_4.6 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

  • 0:3.1.3-14.el8_6.9 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service

  • 0:3.1.3-14.el8_6.9 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions

  • 0:3.1.3-14.el8_6.9 and laternot affected · rpm

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2024-12084Rsync: heap buffer overflow in rsync due to improper checksum length handling
  61This week
• CVE-2017-16548The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name…
  41Plan
• CVE-2017-17434The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data…
  40Plan

Published before and after this one in the same product

• ← EarlierCVE-2024-12085Jan 14, 2025 · Rsync: info leak via uninitialized stack contents
  33Monitor
• ← EarlierCVE-2024-12086Jan 14, 2025 · Rsync: rsync server leaks arbitrary client files
  28Monitor
• Later →CVE-2024-12088Jan 14, 2025 · Rsync: --safe-links option bypass leads to path traversal
  31Monitor

Root cause

A user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const file = path.join(ROOT, req.query.name);2res.sendFile(file);

1const file = path.resolve(ROOT, req.query.name);2if (!file.startsWith(ROOT + path.sep)) {3  return res.sendStatus(400);4}5res.sendFile(file);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.