Rsync Certificate Validation Flaw in Version 3.2.0pre1 and Beyond

CVE-2020-14387

What is CVE-2020-14387?

A security issue has been identified in Rsync affecting versions starting from 3.2.0pre1, involving improper validation of certificates during the rsync-ssl operation. This vulnerability could allow a remote, unauthenticated attacker to execute a man-in-the-middle attack by utilizing a valid certificate for a different hostname. Consequently, this flaw poses a significant risk to the confidentiality and integrity of the data being transmitted, as data could be intercepted and manipulated without detection. Users are advised to upgrade to version 3.2.4 or later to mitigate these risks.

References