CVE-2024-12088 json
Rsync: --safe-links option bypass leads to path traversal
published 2025-01-14 21 mo ago modified 2026-11-05 4 d ago also EUVD-2024-50584 , JLSEC-2025-327
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.6%
- EPSS 4.6% chance of exploitation in 30 days, percentile 91%
- public exploits
- 0
- none known
Summary
A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.
Patch / fix
- julia rsync_jll 3.4.0+0
- Red Hat Red Hat Enterprise Linux 10 0:3.4.1-2.el10
- Red Hat Red Hat Enterprise Linux 8 0:3.1.3-21.el8_10
- Red Hat Red Hat Enterprise Linux 9 0:3.2.5-3.el9
- Red Hat Red Hat Discovery 1.14 1.14.2-1748467619
- rsync Debian 12 3.2.7-1+deb12u1
- rsync Debian 14, Debian 13 3.3.0+ds1-3
debian advisories DEBIAN-CVE-2024-12088
- rsync Ubuntu 20.04 LTS 3.1.3-8ubuntu0.8
- rsync Ubuntu 22.04 LTS 3.2.7-0ubuntu0.22.04.3
- rsync Ubuntu 24.04 LTS 3.2.7-1ubuntu1.1
- rsync Ubuntu Pro 14.04 LTS 3.1.0-2ubuntu0.4+esm1
- rsync Ubuntu Pro 16.04 LTS 3.1.1-3ubuntu1.3+esm3
- rsync Ubuntu Pro 18.04 LTS 3.1.2-2.1ubuntu1.6+esm1
ubuntu advisories UBUNTU-CVE-2024-12088
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- rsync RHEL 10.0 3.4.1-2.el10
- rsync-daemon RHEL 10.0 3.4.1-2.el10
- rsync-rrsync RHEL 10.0 3.4.1-2.el10
- rsync RHEL 9 3.2.5-3.el9
- rsync-daemon RHEL 9 3.2.5-3.el9
- rsync-rrsync RHEL 9 3.2.5-3.el9
- rsync RHEL 8 3.1.3-21.el8_10
- rsync-daemon RHEL 8 3.1.3-21.el8_10
red hat advisories RHBA-2025:6470RHSA-2025:7050RHSA-2025:2600
- rsync Linux Micro 6.1 3.3.0-slfo.1.1_3.1
- rsync Linux Micro 6.0 3.2.7-4.1
- rsync SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +10 more 3.2.3-150400.3.17.1
- rsync SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Micro 5.2 +3 more 3.2.3-150000.4.33.1
- rsync SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 3.2.7-150600.3.8.1
- rsync SLES LTSS Extended Security 12 SP5 3.1.3-3.28.1
- rsync SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 3.1.3-3.22.1
suse advisories SUSE-SU-2025:1330-1SUSE-SU-2025:20223-1SUSE-SU-2025:20122-1SUSE-SU-2025:0166-1SUSE-SU-2025:0165-1SUSE-SU-2025:0157-1
- rsync openSUSE Tumbleweed 3.4.1-1.1
opensuse advisories openSUSE-SU-2025:14665-1
- rsync AlmaLinux 9 3.2.5-3.el9
- rsync-daemon AlmaLinux 9 3.2.5-3.el9
- rsync-rrsync AlmaLinux 9 3.2.5-3.el9
- rsync AlmaLinux 8 3.1.3-21.el8_10
- rsync-daemon AlmaLinux 8 3.1.3-21.el8_10
almalinux advisories ALSA-2025:7050ALSA-2025:2600
- rsync Rocky Linux 9 3.2.5-3.el9
- rsync Rocky Linux 8 3.1.3-21.el8_10
rocky linux advisories RLSA-2025:7050RLSA-2025:2600
- rsync Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 3.4.0-r0
alpine advisories ALPINE-CVE-2024-12088
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- rsync CBL-Mariner 2.0, Azure Linux 3.0 3.4.1-1
azure linux advisories AZL-55658AZL-55676
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- rsync Arch Linux 3.4.0-1
arch linux advisories AVG-2858
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-12088 updated cvss 6.5
rsync: --safe-links option bypass leads to path traversal
-
Red Hat Enterprise Linux 6 rsync Red Hat Enterprise Linux 7 rsyncaffected: workaround, no fix planned “Out of support scope”
-
Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-9affected: workaround, no fix available “Fix deferred”
-
Red Hat Discovery 1.14 discovery 1.14.2-1748467619fixed: vendor fix RHSA-2025:8385
-
Red Hat Enterprise Linux AppStream (v. 9) rsync-daemon 3.2.5-3.el9, rsync-rrsync 3.2.5-3.el9fixed: vendor fix RHSA-2025:7050
-
Red Hat Enterprise Linux AppStream (v. 10) rsync-daemon 3.4.1-2.el10, rsync-rrsync 3.4.1-2.el10fixed: vendor fix RHBA-2025:6470
-
Red Hat Enterprise Linux BaseOS (v. 8) rsync 3.1.3-21.el8_10, rsync-daemon 3.1.3-21.el8_10fixed: vendor fix RHSA-2025:2600
-
Red Hat Enterprise Linux BaseOS (v. 9) rsync 3.2.5-3.el9fixed: vendor fix RHSA-2025:7050
-
Red Hat Enterprise Linux BaseOS (v. 10) rsync 3.4.1-2.el10fixed: vendor fix RHBA-2025:6470
show 1 moreshow fewer
-
Red Hat Discovery 1.14 discovery 1.14.3-1748529279not affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 20 mo ago
Exploit prediction
4.65% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| julia | rsync_jll | <3.4.0+0 |
3.4.0+0 |
Affected products
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Discovery 1.14
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat OpenShift Container Platform 4
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj
exploit, third-party-advisory, web
-
access.redhat.com
/errata/RHBA-2025:6470
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2025:2600
vendor-advisory, third-party-advisory, web
-
access.redhat.com
/errata/RHSA-2025:7050
vendor-advisory, third-party-advisory, web
-
access.redhat.com
/errata/RHSA-2025:8385
vendor-advisory, third-party-advisory, web
-
access.redhat.com
/security/cve/CVE-2024-12088
vdb-entry, third-party-advisory, web
-
bugzilla.redhat.com
/show_bug.cgi?id=2330676
issue-tracking, third-party-advisory, web
-
kb.cert.org
/vuls/id/952657
third-party-advisory, web
-
security.netapp.com
/advisory/ntap-20250131-0002/
web
-
lists.debian.org
/debian-lts-announce/2025/01/msg00008.html
web
-
kb.cert.org
/vuls/id/952657
web
Sources
- CVE List CVE-2024-12088
- NVD CVE-2024-12088
- OSV JLSEC-2025-327
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.