Nixpkgs security tracker

Try the new UI
Login with GitHub

Suggestion detail

Untriaged
Permalink CVE-2026-44509
6.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
created 2 months ago Activity log
  • Created suggestion 2 months ago
Rsync: Symlink races on path-based syscalls

Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, previous bug fixes for symlink races in open() calls missed races in other path based system calls like chmod() and chown(). For rsync daemons with "use chroot = no" this allows an attacker with local filesystem access to change permissions, ownership or timestamp on a file outside the exported module. This issue is fixed in version 3.4.3.

Affected products

rsync
  • ==< 3.4.3

Matching in nixpkgs

pkgs.rsync

Fast incremental file transfer utility

  • nixos-unstable -
    • nixos-unstable-small 3.5.0
  • nixos-26.05 -
    • nixos-26.05-small 3.5.0

pkgs.grsync

Synchronize folders, files and make backups

  • nixos-unstable -
    • nixos-unstable-small 1.3.1
  • nixos-26.05 -
    • nixos-26.05-small 1.3.1

pkgs.rrsync

Helper to run rsync-only environments from ssh-logins

  • nixos-unstable -
    • nixos-unstable-small 3.5.0
  • nixos-26.05 -
    • nixos-26.05-small 3.5.0

pkgs.rsyncy

Progress bar wrapper for rsync

  • nixos-unstable -
    • nixos-unstable-small 2.2.0
  • nixos-26.05 -
    • nixos-26.05-small 2.2.0

pkgs.btrsync

Btrfs replication made easy

  • nixos-unstable -
    • nixos-unstable-small 0.3
  • nixos-26.05 -
    • nixos-26.05-small 0.3

pkgs.parsync

Tool to parallel rsync-like pull sync over SSH

  • nixos-unstable -
    • nixos-unstable-small 0.2.0
  • nixos-26.05 -
    • nixos-26.05-small 0.2.0

pkgs.librsync

Implementation of the rsync remote-delta algorithm

  • nixos-unstable -
    • nixos-unstable-small 2.3.4
  • nixos-26.05 -
    • nixos-26.05-small 2.3.4

pkgs.diskrsync

Rsync for block devices and disk images

  • nixos-unstable -
    • nixos-unstable-small 1.3.0
  • nixos-26.05 -
    • nixos-26.05-small 1.3.0

pkgs.lazyrsync

Terminal UI for rsync with profiles, dry-run preview and live progress

  • nixos-unstable -
    • nixos-unstable-small 0.3.0

pkgs.vdirsyncer

Synchronize calendars and contacts

  • nixos-unstable -
  • nixos-26.05 -

pkgs.sqlite-rsync

Database remote-copy tool for SQLite

  • nixos-unstable -
  • nixos-26.05 -

Package maintainers