CVE-2022-29154
Published: 2 August 2022
An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).
Notes
| Author | Note |
|---|---|
| mdeslaur | two additional commits were added later on...need to check if more go in before the official release |
| rodrigo-zaiden | Another commit was found to be part of the collection for this CVE. 4 in total seems to address it. The missing commit was added in historical order in the Patches section here. |
| mdeslaur | many more commits were added into 3.2.5 than what is listed below 3.2.5 introduced regressions which were fixed in 3.2.6 and 3.2.7 |
Priority
Status
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.4 |
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H |