A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2025:2600 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2025:7050 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2025:8385 | Third Party Advisory |
| https://access.redhat.com/security/cve/CVE-2024-12088 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2330676 | Issue Tracking Third Party Advisory |
| https://kb.cert.org/vuls/id/952657 | Third Party Advisory |
| https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
Configuration 6 (hide)
|
Configuration 7 (hide)
|
Configuration 8 (hide)
|
History
12 Aug 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
18 Jun 2025, 16:29
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Tritondatacenter smartos
Redhat enterprise Linux For Power Little Endian Eus Almalinux almalinux Samba rsync Gentoo linux Gentoo Samba Redhat enterprise Linux Server Aus Redhat enterprise Linux For Ibm Z Systems Eus Redhat enterprise Linux Eus Redhat enterprise Linux Server For Power Little Endian Update Services For Sap Solutions Novell Nixos nixos Archlinux Redhat discovery Novell suse Linux Redhat enterprise Linux For Power Little Endian Redhat Archlinux arch Linux Redhat enterprise Linux For Ibm Z Systems Redhat enterprise Linux Update Services For Sap Solutions Almalinux Tritondatacenter Redhat enterprise Linux For Arm 64 Redhat openshift Container Platform Nixos Redhat enterprise Linux For Arm 64 Eus Redhat enterprise Linux |
|
| CWE | CWE-22 | |
| CPE | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:gentoo:linux:-:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.6_ppc64le:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:* cpe:2.3:a:redhat:discovery:1.14:*:*:*:*:*:*:* cpe:2.3:o:almalinux:almalinux:9.0:-:*:*:*:*:*:* cpe:2.3:o:almalinux:almalinux:8.0:-:*:*:*:*:*:* cpe:2.3:o:nixos:nixos:*:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:* cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:* cpe:2.3:o:almalinux:almalinux:10.0:-:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.6:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64:*:*:*:*:*:*:* cpe:2.3:o:novell:suse_linux:-:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:9.6:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:* cpe:2.3:o:tritondatacenter:smartos:*:*:*:*:*:*:*:* cpe:2.3:o:archlinux:arch_linux:-:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.6_aarch64:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* |
|
| References | () https://access.redhat.com/errata/RHSA-2025:2600 - Third Party Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2025:7050 - Third Party Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2025:8385 - Third Party Advisory | |
| References | () https://access.redhat.com/security/cve/CVE-2024-12088 - Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2330676 - Issue Tracking, Third Party Advisory | |
| References | () https://kb.cert.org/vuls/id/952657 - Third Party Advisory | |
| References | () https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj - Third Party Advisory |
02 Jun 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
13 May 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
11 Mar 2025, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
26 Feb 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
10 Feb 2025, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
|
| Summary | (en) A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory. |
14 Jan 2025, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
14 Jan 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-01-14 18:15
Updated : 2025-08-12 21:15
NVD link : CVE-2024-12088
Mitre link : CVE-2024-12088
CVE.ORG link : CVE-2024-12088
JSON object : View
Products Affected
almalinux
- almalinux
samba
- rsync
redhat
- openshift_container_platform
- enterprise_linux
- enterprise_linux_for_arm_64_eus
- enterprise_linux_for_arm_64
- enterprise_linux_for_ibm_z_systems_eus
- enterprise_linux_update_services_for_sap_solutions
- enterprise_linux_for_ibm_z_systems
- enterprise_linux_for_power_little_endian_eus
- enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
- enterprise_linux_server_aus
- discovery
- enterprise_linux_for_power_little_endian
- enterprise_linux_eus
archlinux
- arch_linux
gentoo
- linux
novell
- suse_linux
tritondatacenter
- smartos
nixos
- nixos
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')