MGASA-2022-0302 - Updated rsync packages fix security vulnerability Publication date: 25 Aug 2022 URL: https://advisories.mageia.org/MGASA-2022-0302.html Type: security Affected Mageia releases: 8 CVE: CVE-2022-29154 An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file). (CVE-2022-29154) References: - https://bugs.mageia.org/show_bug.cgi?id=30696 - https://seclists.org/oss-sec/2022/q3/77 - https://www.openwall.com/lists/oss-security/2022/08/02/1 - https://lists.opensuse.org/archives/list/[email protected]/thread/OZDMOCCGHF4NPIRQFQC2LBFH6YXI6QMU/ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29154 SRPMS: - 8/core/rsync-3.2.2-2.1.mga8
Mageia 2022-0302: rsync security update
An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers
Summary
An issue was discovered in rsync before 3.2.5 that allows malicious remote
servers to write arbitrary files inside the directories of connecting
peers. The server chooses which files/directories are sent to the client.
However, the rsync client performs insufficient validation of file names.
A malicious rsync server (or Man-in-The-Middle attacker) can overwrite
arbitrary files in the rsync client target directory and subdirectories
(for example, overwrite the .ssh/authorized_keys file). (CVE-2022-29154)
References
- https://bugs.mageia.org/show_bug.cgi?id=30696
- https://seclists.org/oss-sec/2022/q3/77
- https://www.openwall.com/lists/oss-security/2022/08/02/1
- https://lists.opensuse.org/archives/list/[email protected]/thread/OZDMOCCGHF4NPIRQFQC2LBFH6YXI6QMU/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29154
Resolution
MGASA-2022-0302 - Updated rsync packages fix security vulnerability
SRPMS
- 8/core/rsync-3.2.2-2.1.mga8
Severity
Publication date: 25 Aug 2022
URL: https://advisories.mageia.org/MGASA-2022-0302.html
Type: security
CVE: CVE-2022-29154
News
HOWTOs
Features
History of Malware on Linux and What's Being Done to Stop It
A Complete Guide to Security Automation & Reporting Using Open Source Tools
How to Check if Your Linux System is Infected with a Virus
Security Considerations for Azure Linux & Windows Subsystem for Linux Users
Admins Receive Automated Linux Patch Management & Improved Security with ManageEngine Endpoint Central
About Us
Powered By
