PT-2021-9723 · Rsync · Rsync

Published 2021-05-27 · Updated 2024-06-15 · CVE-2020-14387

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions rsync versions 3.2.0pre1 through 3.2.3

Description A flaw in rsync improperly validates certificates, allowing a host mismatch vulnerability. This could enable a remote, unauthenticated attacker to perform a man-in-the-middle attack using a valid certificate for another hostname, compromising the confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this issue is to data confidentiality and integrity.

Recommendations For rsync versions 3.2.0pre1 through 3.2.3, update to version 3.2.4 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-297

Related Identifiers

AZL-7462

CVE-2020-14387

OPENSUSE-SU-2024:11308-1

SUSE-RU-2023:3370-1

Affected Products

Rsync

References · 20

• https://osv.dev/vulnerability/AZL-7462 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14387 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-14387 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14387 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-14387 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1875549 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:11308-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-RU-2023:3370-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-14387 · Vendor Advisory
• https://bugzilla.suse.com/1204538 · Note
• https://suse.com/security/cve/CVE-2017-16548 · Note
• https://bugzilla.suse.com/1201840 · Note
• https://suse.com/security/cve/CVE-2020-14387 · Note
• https://suse.com/security/cve/CVE-2007-4091 · Note
• https://suse.com/security/cve/CVE-2022-29154 · Note