CVE-2024-12086
moderate-risk
Published 2025-01-14
A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client.
Do I need to act?
-
0.64% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.1/10
Medium
NETWORK
/ HIGH complexity
Affected Products (15)
Rsync
Arch Linux
Linux
Nixos
Smartos
References (7)
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2024-12086
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2330577
Third Party Advisory
https://kb.cert.org/vuls/id/952657
39
/ 100
moderate-risk
Severity
19/34 · Moderate
Exploitability
2/34 · Minimal
Exposure
18/34 · Moderate