]> git.ipfire.org Git - thirdparty/openembedded/openembedded-core-contrib.git/commit
rsync: fix CVE-2024-12747
authorArchana Polampalli <archana.polampalli@windriver.com>
Thu, 16 Jan 2025 15:15:09 +0000 (15:15 +0000)
committerSteve Sakoman <steve@sakoman.com>
Wed, 22 Jan 2025 03:13:31 +0000 (19:13 -0800)
commite85beb88add5e94567d7221e00cabfb3d5010be7
treed5e169538eb170808e72a6bb5d4906ff1e2dbffd
parentdad4a83c011310872cce07fc4141e66a98439cb1
rsync: fix CVE-2024-12747

A flaw was found in rsync. This vulnerability arises from a race condition during
rsync's handling of symbolic links. Rsync's default behavior when encountering
symbolic links is to skip them. If an attacker replaced a regular file with a
symbolic link at the right time, it was possible to bypass the default behavior
and traverse symbolic links. Depending on the privileges of the rsync process,
an attacker could leak sensitive information, potentially leading to privilege escalation.

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
meta/recipes-devtools/rsync/files/CVE-2024-12747.patch [new file with mode: 0644]
meta/recipes-devtools/rsync/rsync_3.2.7.bb