CVEvulnerability

CVE-2024-12086

6.8 MEDIUM Published 2025-01-14 Modified 2026-08-21 Official page ↗
Status
Modified
Published
2025-01-14
Last modified
2026-08-21
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
CVSS 3.1 ([email protected])
6.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-390

Description

A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client.

Affected configurations

• samba rsync (<= 3.3.0) • redhat openshift container platform 4.0 • redhat enterprise linux 6.0 • redhat enterprise linux 7.0 • redhat enterprise linux 8.0 • redhat enterprise linux 9.0 • redhat enterprise linux 10.0 • almalinux almalinux 8.0 • almalinux almalinux 9.0 • almalinux almalinux 10.0 • archlinux arch linux • gentoo linux • nixos nixos (< 24.11) • suse suse linux • tritondatacenter smartos (< 20250123)

Related

Weakness · CWE (1)

  • CWE-390 Detection of Error Condition Without Action weakness

References