Path Traversal Vulnerability in rsync Affects Red Hat

CVE-2024-12087

Summary

A path traversal vulnerability in rsync allows a malicious server to exploit the --inc-recursive option, which is often enabled by default. This vulnerability arises from insufficient symlink verification and deduplication checks that occur on a per-file-list basis. An attacker could leverage this flaw to write files outside of the client's intended destination directory, potentially placing harmful files in arbitrary locations that mimic valid directories and paths on the client system.

References