{"schemaVersion":3,"id":"CVE-2024-12747","aliases":["ALPINE-CVE-2024-12747","SUSE-SU-2025:0991-1","UBUNTU-CVE-2024-12747","DEBIAN-CVE-2024-12747"],"status":"published","duplicateOf":null,"title":null,"description":"A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.","dates":{"published":"2025-01-14T17:39:16.031Z","modified":"2026-06-29T23:44:07.636Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.6,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.6,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Alpine","score":5.6,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","exploitability":2.8,"impact":6.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":5.6,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","exploitability":2.8,"impact":6.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":5.6,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","exploitability":2.8,"impact":6.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.6,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00384,"percentile":0.31002,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00384},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00384,"percentile":0.31002}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00384,"percentile":0.31002}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-362","name":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","description":"The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/362.html"}],"affected":[{"vendor":"alpine","product":"rsync","name":"rsync","label":"rsync","ecosystem":"Alpine Linux","cpePart":null,"purl":"pkg:apk/alpine/rsync","purlType":"apk","versions":[{"text":"< 3.4.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.4.0-r0","eol":null,"hubHref":null},{"vendor":"debian","product":"rsync","name":"rsync","label":"rsync","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/rsync","purlType":"deb","versions":[{"text":"< 3.2.7-1+deb12u1","noFixRecorded":false,"fixedIn":null},{"text":"< 3.3.0+ds1-3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.2.7-1+deb12u1 | < 3.3.0+ds1-3","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"rsync","name":"rsync","label":"rsync","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/rsync","purlType":"deb","versions":[{"text":"< 3.1.0-2ubuntu0.4+esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 3.1.1-3ubuntu1.3+esm3","noFixRecorded":false,"fixedIn":null},{"text":"< 3.1.2-2.1ubuntu1.6+esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 3.1.3-8ubuntu0.8","noFixRecorded":false,"fixedIn":null},{"text":"< 3.2.7-0ubuntu0.22.04.3","noFixRecorded":false,"fixedIn":null},{"text":"< 3.2.7-1ubuntu1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.1.0-2ubuntu0.4+esm1 | < 3.1.1-3ubuntu1.3+esm3 | < 3.1.2-2.1ubuntu1.6+esm1 | < 3.1.3-8ubuntu0.8 | < 3.2.7-0ubuntu0.22.04.3 | < 3.2.7-1ubuntu1.1","eol":null,"hubHref":null},{"vendor":"suse","product":"rsync&distro=SUSE Enterprise Storage 7.1","name":"rsync","label":"rsync&distro=SUSE Enterprise Storage 7.1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/rsync&distro=SUSE Enterprise Storage 7.1","purlType":"rpm","versions":[{"text":"< 3.2.3-150000.4.36.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.2.3-150000.4.36.1","eol":null,"hubHref":null},{"vendor":"suse","product":"rsync&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS","name":"rsync","label":"rsync&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/rsync&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS","purlType":"rpm","versions":[{"text":"< 3.2.3-150000.4.36.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.2.3-150000.4.36.1","eol":null,"hubHref":null},{"vendor":"suse","product":"rsync&distro=SUSE Linux Enterprise Micro 5.1","name":"rsync","label":"rsync&distro=SUSE Linux Enterprise Micro 5.1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/rsync&distro=SUSE Linux Enterprise Micro 5.1","purlType":"rpm","versions":[{"text":"< 3.2.3-150000.4.36.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.2.3-150000.4.36.1","eol":null,"hubHref":null},{"vendor":"suse","product":"rsync&distro=SUSE Linux Enterprise Micro 5.2","name":"rsync","label":"rsync&distro=SUSE Linux Enterprise Micro 5.2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/rsync&distro=SUSE Linux Enterprise Micro 5.2","purlType":"rpm","versions":[{"text":"< 3.2.3-150000.4.36.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.2.3-150000.4.36.1","eol":null,"hubHref":null},{"vendor":"suse","product":"rsync&distro=SUSE Linux Enterprise Server 15 SP3-LTSS","name":"rsync","label":"rsync&distro=SUSE Linux Enterprise Server 15 SP3-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/rsync&distro=SUSE Linux Enterprise Server 15 SP3-LTSS","purlType":"rpm","versions":[{"text":"< 3.2.3-150000.4.36.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.2.3-150000.4.36.1","eol":null,"hubHref":null},{"vendor":"suse","product":"rsync&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP3","name":"rsync","label":"rsync&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/rsync&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP3","purlType":"rpm","versions":[{"text":"< 3.2.3-150000.4.36.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.2.3-150000.4.36.1","eol":null,"hubHref":null}],"affectedCount":9,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://access.redhat.com/errata/RHBA-2025:6470","label":"access.redhat.com/errata/RHBA-2025:6470","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:2600","label":"access.redhat.com/errata/RHSA-2025:2600","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7050","label":"access.redhat.com/errata/RHSA-2025:7050","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8385","label":"access.redhat.com/errata/RHSA-2025:8385","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-12747","label":"access.redhat.com/security/cve/CVE-2024-12747","hostname":"access.redhat.com","tags":["VDB Entry","X Refsource REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2332968","label":"bugzilla.redhat.com/show_bug.cgi?id=2332968","hostname":"bugzilla.redhat.com","tags":["Issue Tracking","X Refsource REDHAT"]},{"url":"https://kb.cert.org/vuls/id/952657","label":"kb.cert.org/vuls/id/952657","hostname":"kb.cert.org","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20250131-0002/","label":"security.netapp.com/advisory/ntap-20250131-0002/","hostname":"security.netapp.com","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00008.html","label":"lists.debian.org/debian-lts-announce/2025/01/msg00008.html","hostname":"lists.debian.org","tags":[]},{"url":"https://www.kb.cert.org/vuls/id/952657","label":"www.kb.cert.org/vuls/id/952657","hostname":"www.kb.cert.org","tags":[]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-12747","label":"security.alpinelinux.org/vuln/CVE-2024-12747","hostname":"security.alpinelinux.org","tags":["Advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250991-1/","label":"www.suse.com/support/update/announcement/2025/suse-su-20250991-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1235475","label":"bugzilla.suse.com/1235475","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1237187","label":"bugzilla.suse.com/1237187","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12747","label":"www.suse.com/security/cve/CVE-2024-12747","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://ubuntu.com/security/CVE-2024-12747","label":"ubuntu.com/security/CVE-2024-12747","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-12747","label":"www.cve.org/CVERecord?id=CVE-2024-12747","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://kb.cert.org/vince/comm/case/2083/","label":"kb.cert.org/vince/comm/case/2083/","hostname":"kb.cert.org","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-7206-1","label":"ubuntu.com/security/notices/USN-7206-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7206-3","label":"ubuntu.com/security/notices/USN-7206-3","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-12747","label":"security-tracker.debian.org/tracker/CVE-2024-12747","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12747","label":"nvd.nist.gov/vuln/detail/CVE-2024-12747","hostname":"nvd.nist.gov","tags":["Oval","Advisory"]}],"lineage":{"upstream":[],"downstream":["DLA-4015-1","DSA-5843-1","MGASA-2025-0019","OPENSUSE-SU-2025:14665-1","RHBA-2025:6470","RHSA-2025:2600","RHSA-2025:7050","SUSE-SU-2025:0156-1","SUSE-SU-2025:0157-1","SUSE-SU-2025:0165-1","SUSE-SU-2025:0166-1","SUSE-SU-2025:20122-1","SUSE-SU-2025:20223-1","USN-7206-1"],"duplicates":[],"related":["OPENSUSE-SU-2025:14665-1","SUSE-SU-2025:0156-1","SUSE-SU-2025:0157-1","SUSE-SU-2025:0165-1","SUSE-SU-2025:0166-1","SUSE-SU-2025:20122-1","SUSE-SU-2025:20223-1","USN-7206-1","USN-7206-3"]},"timeline":[{"kind":"published","date":"2025-01-14T17:39:16.031Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-29T23:44:07.636Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":22,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T17:43:00.025Z","stale":false,"partial":false}}