A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2025:2600 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2025:7050 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2025:8385 | Third Party Advisory |
| https://access.redhat.com/security/cve/CVE-2024-12088 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2330676 | Issue Tracking Third Party Advisory |
| https://kb.cert.org/vuls/id/952657 | Third Party Advisory |
| https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
Configuration 6 (hide)
|
Configuration 7 (hide)
|
Configuration 8 (hide)
|
History
18 Jun 2025, 16:29
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:archlinux:arch_linux:-:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.6_ppc64le:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:9.6:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:* cpe:2.3:o:novell:suse_linux:-:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.6_aarch64:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:discovery:1.14:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.6:*:*:*:*:*:*:* cpe:2.3:o:nixos:nixos:*:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:* cpe:2.3:o:almalinux:almalinux:9.0:-:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64:*:*:*:*:*:*:* cpe:2.3:o:almalinux:almalinux:8.0:-:*:*:*:*:*:* cpe:2.3:o:almalinux:almalinux:10.0:-:*:*:*:*:*:* cpe:2.3:o:gentoo:linux:-:*:*:*:*:*:*:* cpe:2.3:o:tritondatacenter:smartos:*:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:* cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:* |
|
| CWE | CWE-22 | |
| First Time |
Nixos nixos
Redhat enterprise Linux Server For Power Little Endian Update Services For Sap Solutions Tritondatacenter smartos Redhat enterprise Linux Novell Redhat enterprise Linux For Power Little Endian Eus Redhat enterprise Linux Eus Redhat enterprise Linux For Power Little Endian Archlinux Samba Redhat enterprise Linux Update Services For Sap Solutions Almalinux Redhat enterprise Linux Server Aus Redhat discovery Redhat enterprise Linux For Arm 64 Eus Novell suse Linux Redhat enterprise Linux For Ibm Z Systems Archlinux arch Linux Redhat enterprise Linux For Ibm Z Systems Eus Almalinux almalinux Gentoo linux Tritondatacenter Redhat Redhat enterprise Linux For Arm 64 Gentoo Nixos Redhat openshift Container Platform Samba rsync |
|
| References |
|
|
| References | () https://access.redhat.com/errata/RHSA-2025:2600 - Third Party Advisory | |
| References | () https://access.redhat.com/security/cve/CVE-2024-12088 - Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2330676 - Issue Tracking, Third Party Advisory | |
| References | () https://kb.cert.org/vuls/id/952657 - Third Party Advisory | |
| References | () https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj - Third Party Advisory |
11 Mar 2025, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
26 Feb 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
10 Feb 2025, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
|
| Summary | (en) A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory. |
14 Jan 2025, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
14 Jan 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-01-14 18:15
Updated : 2025-06-18 16:29
NVD link : CVE-2024-12088
Mitre link : CVE-2024-12088
CVE.ORG link : CVE-2024-12088
JSON object : View
Products Affected
redhat
- enterprise_linux
- enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
- enterprise_linux_update_services_for_sap_solutions
- enterprise_linux_for_ibm_z_systems
- enterprise_linux_for_arm_64
- openshift_container_platform
- enterprise_linux_eus
- enterprise_linux_for_power_little_endian_eus
- enterprise_linux_for_ibm_z_systems_eus
- discovery
- enterprise_linux_for_arm_64_eus
- enterprise_linux_server_aus
- enterprise_linux_for_power_little_endian
archlinux
- arch_linux
samba
- rsync
novell
- suse_linux
nixos
- nixos
gentoo
- linux
tritondatacenter
- smartos
almalinux
- almalinux