A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.
2025-01-14T18:15:25.643
2025-06-18T16:29:29.573
Analyzed
CVSSv3.1: 6.5 (MEDIUM)
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | samba | rsync | ≤ 3.3.0 | Yes |
| Application | redhat | discovery | 1.14 | Yes |
| Application | redhat | openshift_container_platform | 4.0 | Yes |
| Operating System | redhat | enterprise_linux | 6.0 | Yes |
| Operating System | redhat | enterprise_linux | 7.0 | Yes |
| Operating System | redhat | enterprise_linux | 8.0 | Yes |
| Operating System | redhat | enterprise_linux | 9.0 | Yes |
| Operating System | redhat | enterprise_linux | 10.0 | Yes |
| Operating System | redhat | enterprise_linux_eus | 9.6 | Yes |
| Operating System | redhat | enterprise_linux_for_arm_64 | 8.0_aarch64 | Yes |
| Operating System | redhat | enterprise_linux_for_arm_64 | 9.0_aarch64 | Yes |
| Operating System | redhat | enterprise_linux_for_arm_64_eus | 9.6_aarch64 | Yes |
| Operating System | redhat | enterprise_linux_for_ibm_z_systems | 8.0_s390x | Yes |
| Operating System | redhat | enterprise_linux_for_ibm_z_systems | 9.0_s390x | Yes |
| Operating System | redhat | enterprise_linux_for_ibm_z_systems_eus | 9.6_s390x | Yes |
| Operating System | redhat | enterprise_linux_for_power_little_endian | 8.0_ppc64le | Yes |
| Operating System | redhat | enterprise_linux_for_power_little_endian | 9.0_ppc64le | Yes |
| Operating System | redhat | enterprise_linux_for_power_little_endian_eus | 9.6_ppc64le | Yes |
| Operating System | redhat | enterprise_linux_server_aus | 9.6 | Yes |
| Operating System | redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 9.6_ppc64le | Yes |
| Operating System | redhat | enterprise_linux_update_services_for_sap_solutions | 9.6 | Yes |
| Operating System | archlinux | arch_linux | - | Yes |
| Operating System | gentoo | linux | - | Yes |
| Operating System | nixos | nixos | < 24.11 | Yes |
| Operating System | novell | suse_linux | - | Yes |
| Operating System | tritondatacenter | smartos | < 20250123 | Yes |
| Operating System | almalinux | almalinux | 8.0 | Yes |
| Operating System | almalinux | almalinux | 9.0 | Yes |
| Operating System | almalinux | almalinux | 10.0 | Yes |