PT-2021-22703 · Rsync+1 · Rsync+1

Published 2021-11-19 · Updated 2025-07-29 · CVE-2021-3978

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: octorpki versions up to 1.4.1

Description: The issue arises when octorpki uses the "-a" flag with rsync, which forces the copying of binaries with the suid bit set as root. Given that the service definition defaults to root, this could potentially allow for a local privilege escalation vector when combined with another vulnerability that causes octorpki to process a malicious TAL file.

Recommendations: octorpki versions up to 1.4.1: Update the service definition to not default to root and avoid using the "-a" flag with rsync to prevent copying binaries with the suid bit set as root. As a temporary workaround, consider restricting access to the rsync command and the octorpki service to minimize the risk of exploitation.

Fix

LPE

Improper Privilege Management

Improper Preservation of Permissions

Weakness Enumeration

CWE-269

CWE-281

Related Identifiers

CVE-2021-3978

DSA-5041-1

GHSA-3PQH-P72C-FJ85

GO-2022-0580

Affected Products

Octorpki

Rsync

References · 17

• https://github.com/cloudflare/cfrpki/security/advisories/GHSA-3pqh-p72c-fj85 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0580 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3978 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3978 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-3978 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3978 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3978 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3pqh-p72c-fj85 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3978 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5041-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3978 · Security Note
• https://github.com/cloudflare/cfrpki · Note
• https://t.me/cvedetector/16679 · Telegram Post
• https://t.me/cvenotify/108957 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1884556112936013893 · Twitter Post