CVE-2024-12086: almalinux
Vulnerability summary
CVE-2024-12086 is a medium (CVSS 6.8) vulnerability in almalinux. EPSS estimates a 1.83% chance of exploitation in the next 30 days, higher than 78.5% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 14 · Related 9Timeline
- 14-01-2025PublishedVulnerability first disclosed.
- 21-08-2026Last modifiedVulnerability information updated.
Description
A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client.
CVSS metrics
5 scores · 5 sources · 1 version- CVE.orgCNA6.1MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:NDiffers
- OSV · AlpineEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS trend
Probability
1.83%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
0.00 pp
From 1.83% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundSecurity Research
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Redhat2 products
- enterprise_linuxEOL6.0 | 7.0 | 8.0 | 9.0 | 10.0
- openshift_container_platform4.0
Almalinux1 product
- almalinux8.0 | 9.0 | 10.0
Alpine1 product
- rsync< 3.4.0-r0
Archlinux1 product
Debian1 product
- rsync< 3.2.7-1+deb12u1 | < 3.3.0+ds1-3
Gentoo1 product
- linuxna
Nixos1 product
- nixos< 24.11
Samba1 product
- rsync≤ 3.3.0
Suse1 product
Tritondatacenter1 product
- smartos< 20250123
Ubuntu1 product
- rsync< 3.1.0-2ubuntu0.4+esm1 | < 3.1.1-3ubuntu1.3+esm3 | < 3.1.2-2.1ubuntu1.6+esm1 | < 3.1.3-8ubuntu0.8 | < 3.2.7-0ubuntu0.22.04.3 | < 3.2.7-1ubuntu1.1
11 vendors · 12 products
References
19 links- kb.cert.org/vuls/id/952657Third Party Advisory
- github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqjExploitThird Party Advisory
