Description
A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.
Exploits (1)
References (28)
... and 8 more
Scores
CVSS v3
7.5
EPSS
0.1914
EPSS Percentile
95.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-908
Status
published
Products (50)
almalinux/almalinux
8.0
almalinux/almalinux
9.0
almalinux/almalinux
10.0
archlinux/arch_linux
gentoo/linux
nixos/nixos
< 24.11
Red Hat/Compliance Operator 1
sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498
Red Hat/OpenShift Compliance Operator 1
sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498
Red Hat/Red Hat Enterprise Linux 10
0:3.4.1-2.el10
Red Hat/Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION
0:3.0.6-12.el6_10.1
... and 40 more
Published
Jan 14, 2025
Tracked Since
Feb 18, 2026