CVE-2022-29154

2022-08-0200:00:00

ubuntu.com

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

0.001 Low

EPSS

Percentile

41.1%

JSON

An issue was discovered in rsync before 3.2.5 that allows malicious remote
servers to write arbitrary files inside the directories of connecting
peers. The server chooses which files/directories are sent to the client.
However, the rsync client performs insufficient validation of file names. A
malicious rsync server (or Man-in-The-Middle attacker) can overwrite
arbitrary files in the rsync client target directory and subdirectories
(for example, overwrite the .ssh/authorized_keys file).

Bugs

<https://github.com/WayneD/rsync/issues/356 (regression bug)>
<https://github.com/WayneD/rsync/issues/350 (regression bug)>
<https://github.com/WayneD/rsync/issues/360 (regression bug)>

Notes

Author	Note
mdeslaur	two additional commits were added later on…need to check if more go in before the official release
rodrigo-zaiden	Another commit was found to be part of the collection for this CVE. 4 in total seems to address it. The missing commit was added in historical order in the Patches section here.
mdeslaur	many more commits were added into 3.2.5 than what is listed below 3.2.5 introduced regressions which were fixed in 3.2.6 and 3.2.7

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchrsync< 3.1.2-2.1ubuntu1.6UNKNOWN
ubuntu20.04noarchrsync< 3.1.3-8ubuntu0.5UNKNOWN
ubuntu22.04noarchrsync< 3.2.7-0ubuntu0.22.04.2UNKNOWN