{"schemaVersion":3,"id":"USN-7206-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Several security issues were fixed in rsync\n\nSimon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync\ndid not properly handle checksum lengths. An attacker could use this\nissue to execute arbitrary code. (CVE-2024-12084)\n\nSimon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync\ncompared checksums with uninitialized memory. An attacker could exploit\nthis issue to leak sensitive information. (CVE-2024-12085)\n\nSimon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync\nincorrectly handled file checksums. A malicious server could use this\nto expose arbitrary client files. (CVE-2024-12086)\n\nSimon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync\nmishandled symlinks for some settings. An attacker could exploit this\nto write files outside the intended directory. (CVE-2024-12087)\n\nSimon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync\nfailed to verify symbolic link destinations for some settings. An\nattacker could exploit this for path traversal attacks. (CVE-2024-12088)\n\nAleksei Gorban discovered a race condition in rsync's handling of\nsymbolic links. An attacker could use this to access sensitive\ninformation or escalate privileges. (CVE-2024-12747)","dates":{"published":"2025-01-14T23:32:20.000Z","modified":"2026-06-25T13:32:30.086Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"rsync","name":"rsync","label":"rsync","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/rsync","purlType":"deb","versions":[{"text":"< 3.1.0-2ubuntu0.4+esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 3.1.1-3ubuntu1.3+esm3","noFixRecorded":false,"fixedIn":null},{"text":"< 3.1.2-2.1ubuntu1.6+esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 3.1.3-8ubuntu0.8","noFixRecorded":false,"fixedIn":null},{"text":"< 3.2.7-0ubuntu0.22.04.3","noFixRecorded":false,"fixedIn":null},{"text":"< 3.2.7-1ubuntu1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.1.0-2ubuntu0.4+esm1 | < 3.1.1-3ubuntu1.3+esm3 | < 3.1.2-2.1ubuntu1.6+esm1 | < 3.1.3-8ubuntu0.8 | < 3.2.7-0ubuntu0.22.04.3 | < 3.2.7-1ubuntu1.1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-7206-1","label":"ubuntu.com/security/notices/USN-7206-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-12084","label":"ubuntu.com/security/CVE-2024-12084","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2024-12085","label":"ubuntu.com/security/CVE-2024-12085","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2024-12086","label":"ubuntu.com/security/CVE-2024-12086","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2024-12087","label":"ubuntu.com/security/CVE-2024-12087","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2024-12088","label":"ubuntu.com/security/CVE-2024-12088","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2024-12747","label":"ubuntu.com/security/CVE-2024-12747","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2024-12084","CVE-2024-12085","CVE-2024-12086","CVE-2024-12087","CVE-2024-12088","CVE-2024-12747"],"downstream":[],"duplicates":[],"related":["CVE-2024-12084","CVE-2024-12085","CVE-2024-12086","CVE-2024-12087","CVE-2024-12088","CVE-2024-12747"]},"timeline":[{"kind":"published","date":"2025-01-14T23:32:20.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-25T13:32:30.086Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T03:06:23.102Z","stale":false,"partial":false}}