Nixpkgs Security Tracker

Login with GitHub

Suggestion detail

Untriaged
(browse all)
created 4 months, 3 weeks ago
Rsync: race condition in rsync handling symbolic links

A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.

Affected products

rhcos
rsync
  • =<3.3.0
  • *
discovery/discovery-ui-rhel9
  • *
registry.redhat.io/discovery/discovery-ui-rhel9
  • *

Matching in nixpkgs

pkgs.rsync

Fast incremental file transfer utility

  • nixos-unstable -

pkgs.grsync

Synchronize folders, files and make backups

  • nixos-unstable -

pkgs.rrsync

Helper to run rsync-only environments from ssh-logins

  • nixos-unstable -

pkgs.rsyncy

Progress bar wrapper for rsync

  • nixos-unstable -

pkgs.librsync

Implementation of the rsync remote-delta algorithm

  • nixos-unstable -

pkgs.diskrsync

Rsync for block devices and disk images

  • nixos-unstable -

pkgs.ethersync

Real-time co-editing of local text files

  • nixos-unstable -

Package maintainers