Medium severity · published Jan 14, 2025
CVE-2024-12086
A flaw was found in rsync
6.8
CVSS
1.8%
EPSS
No
On KEV
Description
A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AL
Almalinux · Almalinux
8.0; 9.0; 10.0 · source: NVD
AL
Arch Linux · Archlinux
All versions, or not specified · source: NVD
EL
Enterprise Linux · Redhat
6.0; 7.0; 8.0; 9.0; 10.0 · source: NVD
LI
Linux · Gentoo
All versions, or not specified · source: NVD
NI
Nixos · Nixos
before 24.11 · source: NVD
RS
Rsync · Samba
through 3.3.0 · source: NVD
SM
Smartos · Tritondatacenter
before 20250123 · source: NVD
SL
Suse Linux · Suse
All versions, or not specified · source: NVD