SUSE-SU-2025:20223-1
Security update for rsync
Severidad por fuente
Ninguna fuente da una puntuación CVSS.
La etiqueta propia de Trivy es CRITICAL. Crítica según SUSE.
Descripción
This update for rsync fixes the following issues: - Bump protocol version to 32 - make it easier to show server is patched. - Fix FLAG_GOT_DIR_FLIST collission with FLAG_HLINKED - Security update,CVE-2024-12747, bsc#1235475 race condition in handling symbolic links - Security update, fix multiple vulnerabilities: * CVE-2024-12084, bsc#1234100 - Heap Buffer Overflow in Checksum Parsing * CVE-2024-12085, bsc#1234101 - Info Leak via uninitialized Stack contents defeats ASLR * CVE-2024-12086, bsc#1234102 - Server leaks arbitrary client files * CVE-2024-12087, bsc#1234103 - Server can make client write files outside of destination directory using symbolic links * CVE-2024-12088, bsc#1234104 - --safe-links Bypass
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| SUSE Linux Enterprise Micro 6.1 | rsync | 3.3.0-slfo.1.1_3.1 |
Referencias
- https://bugzilla.suse.com/1234100
- https://bugzilla.suse.com/1234101
- https://bugzilla.suse.com/1234102
- https://bugzilla.suse.com/1234103
- https://bugzilla.suse.com/1234104
- https://bugzilla.suse.com/1235475
- https://lists.suse.com/pipermail/sle-security-updates/2025-June/021107.html
- https://www.suse.com/security/cve/CVE-2024-12084/
Las 15 referencias
- https://www.suse.com/security/cve/CVE-2024-12085/
- https://www.suse.com/security/cve/CVE-2024-12086/
- https://www.suse.com/security/cve/CVE-2024-12087/
- https://www.suse.com/security/cve/CVE-2024-12088/
- https://www.suse.com/security/cve/CVE-2024-12747/
- https://www.suse.com/support/security/rating/
- https://www.suse.com/support/update/announcement/2025/suse-su-202520223-1/