Skip to content
Fencer Vulns
high 7.4

CVE-2022-29154 json

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of conne…

published 2022-08-02 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-33562

cvss
7.4
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.3%
EPSS 2.3% chance of exploitation in 30 days, percentile 83%
public exploits
0
none known

Summary

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).

Patch / fix

  • samba rsync 3.2.5
  • rsync Debian 14, Debian 13, Debian 12 3.2.5-1

debian advisories DEBIAN-CVE-2022-29154

  • rsync Ubuntu 18.04 LTS 3.1.2-2.1ubuntu1.6
  • rsync Ubuntu 20.04 LTS 3.1.3-8ubuntu0.5
  • rsync Ubuntu 22.04 LTS 3.2.7-0ubuntu0.22.04.2

ubuntu advisories UBUNTU-CVE-2022-29154

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rsync RHEL 8 3.1.3-14.el8_6.3
  • rsync-daemon RHEL 8 3.1.3-14.el8_6.3
  • rsync RHEL 9 3.2.3-9.el9_0.2
  • rsync-daemon RHEL 9 3.2.3-9.el9_0.2
  • rsync RHEL 7 3.1.2-11.el7_9
  • redhat-virtualization-host rhev hypervisor 4.4 4.5.2-202209140405_8.6
  • redhat-virtualization-host-image-update rhev hypervisor 4.4 4.5.2-202209140405_8.6
  • rsync RHEL 8.2 EUS 3.1.3-7.el8_2.2

red hat advisories RHSA-2022:6172RHSA-2022:6180RHSA-2022:6181RHSA-2022:6170RHSA-2022:6173RHSA-2022:6551

  • rsync SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES for SAP 15 SP1 +13 more 3.2.3-150000.4.23.2
  • rsync SLES 15 SP2-BCL, SLES 15 SP1-BCL, SLE Module for Basesystem 15 SP3 +21 more 3.1.3-150000.4.13.1
  • rsync SLES for SAP 12 SP4, SLES 12 SP4-LTSS, SLES 12 SP3-BCL +3 more 3.1.0-13.19.1
  • rsync SLES for SAP 12 SP5, SLES 12 SP5 3.1.3-3.9.1
  • rsync SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 3.2.3-150400.3.3.1

suse advisories SUSE-RU-2023:3370-1SUSE-SU-2022:2959-2SUSE-SU-2022:2959-1SUSE-SU-2022:2859-1SUSE-SU-2022:2858-1SUSE-SU-2022:2825-1

  • rsync openSUSE Tumbleweed 3.2.4-3.1

opensuse advisories openSUSE-SU-2024:12232-1

  • rsync AlmaLinux 8 3.1.3-14.el8_6.3
  • rsync-daemon AlmaLinux 8 3.1.3-14.el8_6.3

almalinux advisories ALSA-2022:6180

  • rsync Rocky Linux 9 3.2.3-9.el9_0.2
  • rsync Rocky Linux 8 3.1.3-14.el8_6.3

rocky linux advisories RLSA-2022:6181RLSA-2022:6180

  • rsync Alpine 3.15, Alpine 3.14, Alpine 3.13 3.2.4-r0
  • rsync Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 3.2.4-r2

alpine advisories ALPINE-CVE-2022-29154

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rsync CBL-Mariner 2.0 3.2.5-1

azure linux advisories AZL-10461

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-29154 updated cvss 7.4

rsync: remote arbitrary files write inside the directories of connecting peers

  • Red Hat Enterprise Linux 6 rsync
    affected: workaround, no fix planned “Only connecting to trusted Rsync servers over trusted channels would help to mitigate this flaw.”
  • Red Hat Enterprise Linux AppStream (v. 9) rsync-daemon 3.2.3-9.el9_0.2
    fixed: vendor fix “Only connecting to trusted Rsync servers over trusted channels would help to mitigate this flaw.” RHSA-2022:6181
  • Red Hat Enterprise Linux BaseOS (v. 8) rsync 3.1.3-14.el8_6.3, rsync-daemon 3.1.3-14.el8_6.3
    fixed: vendor fix “Only connecting to trusted Rsync servers over trusted channels would help to mitigate this flaw.” RHSA-2022:6180
  • Red Hat Enterprise Linux BaseOS (v. 9) rsync 3.2.3-9.el9_0.2
    fixed: vendor fix “Only connecting to trusted Rsync servers over trusted channels would help to mitigate this flaw.” RHSA-2022:6181
  • Red Hat Enterprise Linux BaseOS E4S (v. 8.1) rsync 3.1.3-6.el8_1.2, rsync-daemon 3.1.3-6.el8_1.2
    fixed: vendor fix “Only connecting to trusted Rsync servers over trusted channels would help to mitigate this flaw.” RHSA-2022:6173
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.2) rsync 3.1.3-7.el8_2.2, rsync-daemon 3.1.3-7.el8_2.2
    fixed: vendor fix “Only connecting to trusted Rsync servers over trusted channels would help to mitigate this flaw.” RHSA-2022:6172
  • Red Hat Enterprise Linux BaseOS EUS (v.8.4) rsync 3.1.3-12.el8_4.2, rsync-daemon 3.1.3-12.el8_4.2
    fixed: vendor fix “Only connecting to trusted Rsync servers over trusted channels would help to mitigate this flaw.” RHSA-2022:6171
  • Red Hat Enterprise Linux Client (v. 7) rsync 3.1.2-11.el7_9 Red Hat Enterprise Linux Server (v. 7) rsync 3.1.2-11.el7_9 Red Hat Enterprise Linux Workstation (v. 7) rsync 3.1.2-11.el7_9
    fixed: vendor fix “Only connecting to trusted Rsync servers over trusted channels would help to mitigate this flaw.” RHSA-2022:6170
show 2 more
  • Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host 4.5.2-202209140405_8.6, redhat-virtualization-host-image-update 4.5.2-202209140405_8.6
    fixed: vendor fix “Only connecting to trusted Rsync servers over trusted channels would help to mitigate this flaw.” RHSA-2022:6551
  • Red Hat RHEL 8-based RHEV-H for RHEV 4 (build requirements) redhat-release-virtualization-host 4.5.2-1.el8ev, redhat-virtualization-host-productimg 4.5.2-1.el8, redhat-release-virtualization-host-content 4.5.2-1.el8ev, redhat-virtualization-host-image-update-placeholder 4.5.2-1.el8ev
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-25-105-08 updated cvss 6.8

ABB M2M Gateway

  • ABB M2M Gateway >=4.1.2, <=5.0.3, >=5.0.1, <=5.0.3
    affected: mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-046-11 updated cvss 7.4

Siemens SCALANCE XCM-/XRM-300

  • Siemens SCALANCE XCH328 (6GK5328-4TS01-2EC2) <V2.4 Siemens SCALANCE XCM324 (6GK5324-8TS01-2AC2) <V2.4 Siemens SCALANCE XCM328 (6GK5328-4TS01-2AC2) <V2.4 Siemens SCALANCE XCM332 (6GK5332-0GA01-2AC2) <V2.4 Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) <V2.4 Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) <V2.4
    +5 more products
    Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) <V2.4
    affected: fixed in V2.4 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

2.35% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • openwall.com http://www.openwall.com/lists/oss-security/2022/08/02/1 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.