Rsync vulnerabilities

by pavodiveon 1/15/2025, 2:45 AMwith 23 comments

by concerndc1tizenon 1/15/2025, 1:50 PM

Do I read correctly that this is related to "rsync daemon" (rsyncd), and therefore has minimal impact on people who just use rsync over ssh?

by jmclnxon 1/15/2025, 1:18 PM

Slackware sent a fixed version of rsync out yesterday.

But I wonder of OpenBSD's openrsync has the same issue ? Or did that version avoid the issues when it was created ?

If it was avoided, seems OpenBSD was ahead of the curve again.

by chasilon 1/15/2025, 4:05 PM

Does this apply to the GPL or BSD codebase?

There are (now) two rsync codebases.

GPL: https://rsync.samba.org/

BSD: https://www.openrsync.org/

by samuelophon 1/15/2025, 6:19 PM

There's a serious regression in the fixes: https://github.com/RsyncProject/rsync/issues/702

It impacts those who need to use `-r` (recursive) together with `-H` (preserve hardlinks),

by ThatGuyRaionon 1/15/2025, 9:39 PM

Are these applicable to the openrsync project?

by captainblandon 1/15/2025, 10:05 PM

> Anonymous read access to a rsync server... such as on a public mirror

I did not know people did that.