Alerts This Week
Warning Icon 1 640
Alerts This Week
Warning Icon 1 640

SUSE Linux Micro: 2025:20223-1 critical: rsync Security Issues

suse
Calendar Grey June 4, 2025
Dist Suse Esm H88
Urgent patch released for openssl addresses various high-severity vulnerabilities affecting Fedora. Immediate implementation advised.
* bsc#1234100 * bsc#1234101 * bsc#1234102 * bsc#1234103 * bsc#1234104

Summary

## This update for rsync fixes the following issues: * Bump protocol version to 32 - make it easier to show server is patched. * Fix FLAG_GOT_DIR_FLIST collission with FLAG_HLINKED * Security update,CVE-2024-12747, bsc#1235475 race condition in handling symbolic links * Security update, fix multiple vulnerabilities: * CVE-2024-12084, bsc#1234100 - Heap Buffer Overflow in Checksum Parsing * CVE-2024-12085, bsc#1234101 - Info Leak via uninitialized Stack contents defeats ASLR * CVE-2024-12086, bsc#1234102 - Server leaks arbitrary client files * CVE-2024-12087, bsc#1234103 - Server can make client write files outside of destination directory using symbolic links * CVE-2024-12088, bsc#1234104 - --safe-links Bypass ## Patch Instructions:

Topics%20covered

Topics Covered

security advisory update critical rsync SUSE file transfer

References

* bsc#1234100

* bsc#1234101

* bsc#1234102

* bsc#1234103

* bsc#1234104

* bsc#1235475

Cross-

* CVE-2024-12084

* CVE-2024-12085

* CVE-2024-12086

* CVE-2024-12087

* CVE-2024-12088

* CVE-2024-12747

CVSS scores:

* CVE-2024-12084 ( SUSE ): 9.3

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

* CVE-2024-12084 ( SUSE ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2024-12084 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2024-12085 ( SUSE ): 6.9

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

* CVE-2024-12085 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

* CVE-2024-12085 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

* CVE-2024-12086 ( SUSE ): 6.9

Severity
critical
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2025:20223-1
Release Date: 2025-02-07T09:57:24Z
Rating: critical

Topics%20covered

Topics Covered

security advisory update critical rsync SUSE file transfer

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here