Medium severity · published Jan 14, 2025
CVE-2024-12086
A flaw was found in rsync
6.8
CVSS
1.8%
EPSS
No
On KEV
Description
A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AL
Almalinux · Almalinux
8.0; 9.0; 10.0 · source: NVD
AL
Arch Linux · Archlinux
All versions, or not specified · source: NVD
EL
Enterprise Linux · Redhat
6.0; 7.0; 8.0; 9.0; 10.0 · source: NVD
LI
Linux · Gentoo
All versions, or not specified · source: NVD
NI
Nixos · Nixos
before 24.11 · source: NVD
OC
Openshift Container Platform · Redhat
4.0 · source: NVD
RS
Rsync · Samba
through 3.3.0 · source: NVD
SM
Smartos · Tritondatacenter
before 20250123 · source: NVD
SL
Suse Linux · Suse
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-12086
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-12086
access.redhat.com
https://access.redhat.com/errata/RHBA-2025:6470
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:19368
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:20603
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:29197
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2024-12086
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2330577
More from Almalinux
9.8
CVE-2024-12084
Rsync: heap buffer overflow in rsync due to improper checksum length handling
8.1
CVE-2024-6387
Openssh: regresshion - race condition in ssh allows rce/dos
7.5
CVE-2024-12087
Rsync: path traversal vulnerability in rsync
7.5
CVE-2024-12088
Rsync: --safe-links option bypass leads to path traversal
7.5
CVE-2024-12085
Rsync: info leak via uninitialized stack contents
