Slackware: 2022-227-01: rsync Security Update | LinuxSecurity.com

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security]  rsync (SSA:2022-227-01)

New rsync packages are available for Slackware 14.0, 14.1, 14.2, 15.0,
and -current to fix a security issue.


Here are the details from the Slackware 15.0 ChangeLog:
+--------------------------+
patches/packages/rsync-3.2.5-i586-1_slack15.0.txz:  Upgraded.
  Added some file-list safety checking that helps to ensure that a rogue
  sending rsync can't add unrequested top-level names and/or include recursive
  names that should have been excluded by the sender. These extra safety
  checks only require the receiver rsync to be updated. When dealing with an
  untrusted sending host, it is safest to copy into a dedicated destination
  directory for the remote content (i.e. don't copy into a destination
  directory that contains files that aren't from the remote host unless you
  trust the remote host).
  For more information, see:
   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29154
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
(https://osuosl.org) for donating FTP and rsync hosting
to the Slackware project!  :-)

Also see the "Get Slack" section on https://slackware.com for
additional mirror sites near you.

Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/rsync-3.2.5-i486-1_slack14.0.txz

Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/rsync-3.2.5-x86_64-1_slack14.0.txz

Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/rsync-3.2.5-i486-1_slack14.1.txz

Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/rsync-3.2.5-x86_64-1_slack14.1.txz

Updated package for Slackware 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/rsync-3.2.5-i586-1_slack14.2.txz

Updated package for Slackware x86_64 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/rsync-3.2.5-x86_64-1_slack14.2.txz

Updated package for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/rsync-3.2.5-i586-1_slack15.0.txz

Updated package for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/rsync-3.2.5-x86_64-1_slack15.0.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/rsync-3.2.5-i586-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/rsync-3.2.5-x86_64-1.txz


MD5 signatures:
+-------------+

Slackware 14.0 package:
3f0ca0f8ed464ca170fde81edaa2c805  rsync-3.2.5-i486-1_slack14.0.txz

Slackware x86_64 14.0 package:
100660633045818b403259797ebe2aa3  rsync-3.2.5-x86_64-1_slack14.0.txz

Slackware 14.1 package:
dd89e119220509baf81a56c176e497a0  rsync-3.2.5-i486-1_slack14.1.txz

Slackware x86_64 14.1 package:
698dfde7b2c3a6a9d7b2b39206c5bf24  rsync-3.2.5-x86_64-1_slack14.1.txz

Slackware 14.2 package:
d330a2802b454e88b29a3c52686cc06e  rsync-3.2.5-i586-1_slack14.2.txz

Slackware x86_64 14.2 package:
366f07d475fae2645d6c446207e5327b  rsync-3.2.5-x86_64-1_slack14.2.txz

Slackware 15.0 package:
81f90b336a233c240c5ed3a7e54635f9  rsync-3.2.5-i586-1_slack15.0.txz

Slackware x86_64 15.0 package:
70a01b72fc4e502650b952ab2e336e93  rsync-3.2.5-x86_64-1_slack15.0.txz

Slackware -current package:
45eb531038158b16250c63c370f8a994  n/rsync-3.2.5-i586-1.txz

Slackware x86_64 -current package:
d67bac8495b92af8160ea7c4b8ed79b3  n/rsync-3.2.5-x86_64-1.txz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg rsync-3.2.5-i586-1_slack15.0.txz


+-----+

Slackware: 2022-227-01: rsync Security Update

August 15, 2022
New rsync packages are available for Slackware 14.0, 14.1, 14.2, 15.0, and -current to fix a security issue

Summary

Here are the details from the Slackware 15.0 ChangeLog: patches/packages/rsync-3.2.5-i586-1_slack15.0.txz: Upgraded. Added some file-list safety checking that helps to ensure that a rogue sending rsync can't add unrequested top-level names and/or include recursive names that should have been excluded by the sender. These extra safety checks only require the receiver rsync to be updated. When dealing with an untrusted sending host, it is safest to copy into a dedicated destination directory for the remote content (i.e. don't copy into a destination directory that contains files that aren't from the remote host unless you trust the remote host). For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29154 (* Security fix *)

Where Find New Packages

Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-)
Also see the "Get Slack" section on https://slackware.com for additional mirror sites near you.
Updated package for Slackware 14.0: ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/rsync-3.2.5-i486-1_slack14.0.txz
Updated package for Slackware x86_64 14.0: ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/rsync-3.2.5-x86_64-1_slack14.0.txz
Updated package for Slackware 14.1: ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/rsync-3.2.5-i486-1_slack14.1.txz
Updated package for Slackware x86_64 14.1: ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/rsync-3.2.5-x86_64-1_slack14.1.txz
Updated package for Slackware 14.2: ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/rsync-3.2.5-i586-1_slack14.2.txz
Updated package for Slackware x86_64 14.2: ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/rsync-3.2.5-x86_64-1_slack14.2.txz
Updated package for Slackware 15.0: ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/rsync-3.2.5-i586-1_slack15.0.txz
Updated package for Slackware x86_64 15.0: ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/rsync-3.2.5-x86_64-1_slack15.0.txz
Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/rsync-3.2.5-i586-1.txz
Updated package for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/rsync-3.2.5-x86_64-1.txz

MD5 Signatures

Slackware 14.0 package: 3f0ca0f8ed464ca170fde81edaa2c805 rsync-3.2.5-i486-1_slack14.0.txz
Slackware x86_64 14.0 package: 100660633045818b403259797ebe2aa3 rsync-3.2.5-x86_64-1_slack14.0.txz
Slackware 14.1 package: dd89e119220509baf81a56c176e497a0 rsync-3.2.5-i486-1_slack14.1.txz
Slackware x86_64 14.1 package: 698dfde7b2c3a6a9d7b2b39206c5bf24 rsync-3.2.5-x86_64-1_slack14.1.txz
Slackware 14.2 package: d330a2802b454e88b29a3c52686cc06e rsync-3.2.5-i586-1_slack14.2.txz
Slackware x86_64 14.2 package: 366f07d475fae2645d6c446207e5327b rsync-3.2.5-x86_64-1_slack14.2.txz
Slackware 15.0 package: 81f90b336a233c240c5ed3a7e54635f9 rsync-3.2.5-i586-1_slack15.0.txz
Slackware x86_64 15.0 package: 70a01b72fc4e502650b952ab2e336e93 rsync-3.2.5-x86_64-1_slack15.0.txz
Slackware -current package: 45eb531038158b16250c63c370f8a994 n/rsync-3.2.5-i586-1.txz
Slackware x86_64 -current package: d67bac8495b92af8160ea7c4b8ed79b3 n/rsync-3.2.5-x86_64-1.txz

Severity
[slackware-security] rsync (SSA:2022-227-01)
New rsync packages are available for Slackware 14.0, 14.1, 14.2, 15.0, and -current to fix a security issue.

Installation Instructions

Installation instructions: Upgrade the package as root: # upgradepkg rsync-3.2.5-i586-1_slack15.0.txz

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.