Log in Start free

Vulnerability · Published Aug 2, 2022 · Assigned by mitre

CVE-2022-29154

High 7.4

In plain English

A high-severity security flaw in the rsync package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 84% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.4High
Exploit odds (30 days)2.3%top 16.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC

Official description

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8rsync3.1.3-14.el8_6.3ALSA-2022:6180
AlmaLinux:8rsync-daemon3.1.3-14.el8_6.3ALSA-2022:6180
Alpine:v3.20rsync3.2.4-r2ALPINE-CVE-2022-29154
Alpine:v3.21rsync3.2.4-r2ALPINE-CVE-2022-29154
Alpine:v3.22rsync3.2.4-r2ALPINE-CVE-2022-29154
Alpine:v3.23rsync3.2.4-r2ALPINE-CVE-2022-29154
Alpine:v3.24rsync3.2.4-r2ALPINE-CVE-2022-29154
Debian:12rsync3.2.5-1DEBIAN-CVE-2022-29154
Debian:13rsync3.2.5-1DEBIAN-CVE-2022-29154
Debian:14rsync3.2.5-1DEBIAN-CVE-2022-29154
Rocky Linux:8rsync0:3.1.3-14.el8_6.3RLSA-2022:6180
Rocky Linux:9rsync0:3.2.3-9.el9_0.2RLSA-2022:6181
Ubuntu:22.04:LTSrsync3.2.7-0ubuntu0.22.04.2UBUNTU-CVE-2022-29154
Ubuntu:22.04:LTSrsync3.2.7-0ubuntu0.22.04.2USN-5921-1

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References