Yüksek CVSS 7.5
CVE-2024-12088: Rsync: dizin geçişi
Açıklama (NVD)
A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.
Özet bilgiler
- Ürün
- Samba Rsync
- CVSS v3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - EPSS
- %4,65 (yüzdelik 92)
- CWE
- CWE-22
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| samba-rsync | — | 3.3.0 | — |
| redhat-discovery | 1.14 | 1.14 | — |
| redhat-openshift-container-platform | 4.0 | 4.0 | — |
| redhat-enterprise-linux | 6.0 | 6.0 | — |
| redhat-enterprise-linux | 7.0 | 7.0 | — |
| redhat-enterprise-linux | 8.0 | 8.0 | — |
| redhat-enterprise-linux | 9.0 | 9.0 | — |
| redhat-enterprise-linux | 10.0 | 10.0 | — |
| redhat-enterprise-linux-eus | 9.6 | 9.6 | — |
| redhat-enterprise-linux-for-arm-64 | 8.0_aarch64 | 8.0_aarch64 | — |
| redhat-enterprise-linux-for-arm-64 | 9.0_aarch64 | 9.0_aarch64 | — |
| redhat-enterprise-linux-for-arm-64-eus | 9.6_aarch64 | 9.6_aarch64 | — |
| redhat-enterprise-linux-for-ibm-z-systems | 8.0_s390x | 8.0_s390x | — |
| redhat-enterprise-linux-for-ibm-z-systems | 9.0_s390x | 9.0_s390x | — |
| redhat-enterprise-linux-for-ibm-z-systems-eus | 9.6_s390x | 9.6_s390x | — |
| redhat-enterprise-linux-for-power-little-endian | 8.0_ppc64le | 8.0_ppc64le | — |
| redhat-enterprise-linux-for-power-little-endian | 9.0_ppc64le | 9.0_ppc64le | — |
| redhat-enterprise-linux-for-power-little-endian-eus | 9.6_ppc64le | 9.6_ppc64le | — |
| redhat-enterprise-linux-server-aus | 9.6 | 9.6 | — |
| redhat-enterprise-linux-server-for-power-little-endian-update-services-for-sap-solutions | 9.6_ppc64le | 9.6_ppc64le | — |
| redhat-enterprise-linux-update-services-for-sap-solutions | 9.6 | 9.6 | — |
| archlinux-arch-linux | — | — | — |
| gentoo-linux | — | — | — |
| nixos-nixos | — | — | 24.11 |
| novell-suse-linux | — | — | — |
| tritondatacenter-smartos | — | — | 20250123 |
| almalinux-almalinux | 8.0 | 8.0 | — |
| almalinux-almalinux | 9.0 | 9.0 | — |
| almalinux-almalinux | 10.0 | 10.0 | — |