High severity · published Jan 14, 2025
CVE-2024-12085
Rsync: info leak via uninitialized stack contents
7.5
CVSS
8.6%
EPSS
No
On KEV
Description
A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)8.6% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Compliance Operator 1 · Red Hat
All versions, or not specified · source: vendor
RH
RHOL-5.8-RHEL-9 · Red Hat
All versions, or not specified · source: vendor
RH
RHOL-5.9-RHEL-9 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 7 Extended Lifecycle Support · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8.2 Advanced Update Support · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8.4 Telecommunications Update Service · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support · Red Hat
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-12085
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-12085
vendor-advisory
https://access.redhat.com/errata/RHBA-2025:6470
vendor-advisory
https://access.redhat.com/errata/RHSA-2024:6122
vendor-advisory
https://access.redhat.com/errata/RHSA-2025:0324
vendor-advisory
https://access.redhat.com/errata/RHSA-2025:0325
vendor-advisory
https://access.redhat.com/errata/RHSA-2025:0637
vendor-advisory
https://access.redhat.com/errata/RHSA-2025:0688
More from Compliance Operator 1
8.2
CVE-2026-33810
Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509
7.8
CVE-2025-7425
Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr
7.8
CVE-2025-6020
Linux-pam: linux-pam directory traversal
7.8
CVE-2025-5914
Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c
7.5
CVE-2026-33811
Crash when handling long CNAME response in net