MGASA-2017-0452

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2017-0452.html
Import Source
https://advisories.mageia.org/MGASA-2017-0452.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2017-0452
Related
Published
2017-12-16T23:20:04Z
Modified
2017-12-16T22:55:20Z
Summary
Updated rsync package fixes security vulnerabilities
Details

The recvfiles function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemonfilter_list data structure, which allows remote attackers to bypass intended access restrictions. (CVE-2017-17433)

The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemonfilterlist data structure (in the recvfiles function in receiver.c) and also does not apply the sanitizepaths protection mechanism to pathnames found in "xname follows" strings (in the readndxand_attrs function in rsync.c), which allows remote attackers to bypass intended access restrictions. (CVE-2017-17434)

References
Credits

Affected packages

Mageia:5 / rsync

Package

Name
rsync
Purl
pkg:rpm/mageia/rsync?distro=mageia-5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.1.1-5.2.mga5

Ecosystem specific 

{
    "section": "core"
}

Mageia:6 / rsync

Package

Name
rsync
Purl
pkg:rpm/mageia/rsync?distro=mageia-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.1.2-1.1.mga6

Ecosystem specific 

{
    "section": "core"
}