Yüksek CVSS 7.5 PoC var
CVE-2024-12087: Rsync: dizin geçişi
Açıklama (NVD)
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.
Özet bilgiler
- Ürün
- Samba Rsync
- CVSS v3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - EPSS
- %2,26 (yüzdelik 83)
- CWE
- CWE-22
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| samba-rsync | — | 3.3.0 | — |
| almalinux-almalinux | 8.0 | 8.0 | — |
| almalinux-almalinux | 9.0 | 9.0 | — |
| almalinux-almalinux | 10.0 | 10.0 | — |
| archlinux-arch-linux | — | — | — |
| gentoo-linux | — | — | — |
| nixos-nixos | — | — | 24.11 |
| suse-suse-linux | — | — | — |
| tritondatacenter-smartos | — | — | 20250123 |
| redhat-enterprise-linux | 8.0 | 8.0 | — |
| redhat-enterprise-linux | 9.0 | 9.0 | — |
| redhat-enterprise-linux-eus | 9.6 | 9.6 | — |
| redhat-enterprise-linux-for-arm-64 | 8.0_aarch64 | 8.0_aarch64 | — |
| redhat-enterprise-linux-for-arm-64 | 9.0_aarch64 | 9.0_aarch64 | — |
| redhat-enterprise-linux-for-arm-64-eus | 9.6_aarch64 | 9.6_aarch64 | — |
| redhat-enterprise-linux-for-ibm-z-systems | 8.0_s390x | 8.0_s390x | — |
| redhat-enterprise-linux-for-ibm-z-systems | 9.0_s390x | 9.0_s390x | — |
| redhat-enterprise-linux-for-ibm-z-systems-eus | 9.6_s390x | 9.6_s390x | — |
| redhat-enterprise-linux-for-power-little-endian | 8.0_ppc64le | 8.0_ppc64le | — |
| redhat-enterprise-linux-for-power-little-endian | 9.0_ppc64le | 9.0_ppc64le | — |
| redhat-enterprise-linux-for-power-little-endian-eus | 9.6_ppc64le | 9.6_ppc64le | — |
| redhat-enterprise-linux-server-aus | 9.6 | 9.6 | — |
| redhat-enterprise-linux-server-for-power-little-endian-update-services-for-sap-solutions | 9.6_ppc64le | 9.6_ppc64le | — |
| redhat-enterprise-linux-update-services-for-sap-solutions | 9.6 | 9.6 | — |
Kaynaklar
- NVD kaydı
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- bugzilla.redhat.com
- kb.cert.org
- lists.debian.org
- security.netapp.com
- www.kb.cert.org
- github.com
- CWE-22