Bug 2110928 (CVE-2022-29154)

Summary:	CVE-2022-29154 rsync: remote arbitrary files write inside the directories of connecting peers
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	code, fjansen, hobbes1069, kperrier, luhliari, michal.skrivanek, mperina, mruprich, mvanderw, ntait, sbonazzo, security-response-team, ssorce, tcullum
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	rsync 3.2.5pre1	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in rsync that is triggered by a victim rsync user/client connecting to a malicious rsync server. The server can copy and overwrite arbitrary files in the client's rsync target directory and subdirectories. This flaw allows a malicious server, or in some cases, another attacker who performs a man-in-the-middle attack, to potentially overwrite sensitive files on the client machine, resulting in further exploitation.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-09-02 19:55:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2115429, 2115431, 2111170, 2111171, 2111172, 2111173, 2111174, 2111175, 2111176, 2111177, 2115430, 2119138, 2119139
Bug Blocks:	2110929

Description Marian Rehak 2022-07-26 08:11:52 UTC

An arbitrary file write vulnerability in the rsync utility that allows malicious remote servers to write arbitrary files inside the directories of connecting peers.

Comment 10 Todd Cullum 2022-08-04 16:21:42 UTC

Created rsync tracking bugs for this issue:

Affects: fedora-all [bug 2115430]


Created rsync-bpc tracking bugs for this issue:

Affects: epel-all [bug 2115431]
Affects: fedora-all [bug 2115429]

Comment 16 errata-xmlrpc 2022-08-24 17:37:29 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2022:6173 https://access.redhat.com/errata/RHSA-2022:6173

Comment 17 errata-xmlrpc 2022-08-24 17:52:38 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2022:6172 https://access.redhat.com/errata/RHSA-2022:6172

Comment 18 errata-xmlrpc 2022-08-24 18:55:27 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:6181 https://access.redhat.com/errata/RHSA-2022:6181

Comment 19 errata-xmlrpc 2022-08-24 19:55:11 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:6180 https://access.redhat.com/errata/RHSA-2022:6180

Comment 20 errata-xmlrpc 2022-08-24 19:56:47 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2022:6171 https://access.redhat.com/errata/RHSA-2022:6171

Comment 21 errata-xmlrpc 2022-08-24 21:38:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2022:6170 https://access.redhat.com/errata/RHSA-2022:6170

Comment 22 Product Security DevOps Team 2022-09-02 19:55:12 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-29154

Comment 23 errata-xmlrpc 2022-09-19 11:50:34 UTC

This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

Via RHSA-2022:6551 https://access.redhat.com/errata/RHSA-2022:6551