Threats affecting pkg:rpm/redhat/rsync

A time-of-check to time-of-use (TOCTOU) race condition vulnerability exists in the rrsync restricted shell wrapper in rsync versions before 3.5.0. This vulnerability allows directory escape due to a race condition. The issue is part of a broader set of security flaws addressed in rsync updates, including path traversal, command injection, and access control bypasses. The vulnerability has a CVSS score of 8.1, indicating high severity. Red Hat has released patches as part of their security advisory RHSA-2026:67462, which rebases rsync to version 3.2.7 in Red Hat Enterprise Linux 9. The vulnerability affects multiple specific versions of rsync, including various Ubuntu package versions. No known exploits in the wild have been reported at this time.

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es): * rsync: Rsync: Out of bounds array access via negative index (CVE-2025-10158) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es): * rsync: Path traversal vulnerability in rsync (CVE-2024-12087) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.