A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2025:2600 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2025:7050 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2025:8385 | Third Party Advisory |
| https://access.redhat.com/security/cve/CVE-2024-12087 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2330672 | Issue Tracking Third Party Advisory |
| https://kb.cert.org/vuls/id/952657 | Third Party Advisory |
| https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
Configuration 6 (hide)
|
Configuration 7 (hide)
|
Configuration 8 (hide)
|
History
20 Jun 2025, 18:28
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.6_ppc64le:*:*:*:*:*:*:* cpe:2.3:o:almalinux:almalinux:8.0:-:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.6:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:* cpe:2.3:o:almalinux:almalinux:9.0:-:*:*:*:*:*:* cpe:2.3:o:tritondatacenter:smartos:*:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.6_aarch64:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:nixos:nixos:*:*:*:*:*:*:*:* cpe:2.3:o:suse:suse_linux:-:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:9.6:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:* cpe:2.3:o:gentoo:linux:-:*:*:*:*:*:*:* cpe:2.3:o:archlinux:arch_linux:-:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:* cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:* cpe:2.3:o:almalinux:almalinux:10.0:-:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:* |
|
| First Time |
Redhat enterprise Linux For Power Little Endian Eus
Nixos nixos Redhat enterprise Linux For Arm 64 Eus Suse suse Linux Tritondatacenter smartos Gentoo linux Samba rsync Almalinux almalinux Redhat enterprise Linux Server For Power Little Endian Update Services For Sap Solutions Redhat enterprise Linux Redhat enterprise Linux For Ibm Z Systems Almalinux Archlinux arch Linux Redhat enterprise Linux For Arm 64 Nixos Gentoo Redhat enterprise Linux Eus Archlinux Redhat enterprise Linux For Power Little Endian Samba Suse Redhat Redhat enterprise Linux Update Services For Sap Solutions Redhat enterprise Linux For Ibm Z Systems Eus Tritondatacenter Redhat enterprise Linux Server Aus |
|
| CWE | CWE-22 | |
| References | () https://access.redhat.com/errata/RHSA-2025:2600 - Third Party Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2025:7050 - Third Party Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2025:8385 - Third Party Advisory | |
| References | () https://access.redhat.com/security/cve/CVE-2024-12087 - Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2330672 - Issue Tracking, Third Party Advisory | |
| References | () https://kb.cert.org/vuls/id/952657 - Third Party Advisory | |
| References | () https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj - Exploit, Third Party Advisory |
02 Jun 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
13 May 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
11 Mar 2025, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
26 Feb 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
|
| References |
|
14 Jan 2025, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
14 Jan 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-01-14 18:15
Updated : 2025-06-20 18:28
NVD link : CVE-2024-12087
Mitre link : CVE-2024-12087
CVE.ORG link : CVE-2024-12087
JSON object : View
Products Affected
redhat
- enterprise_linux_eus
- enterprise_linux_for_ibm_z_systems
- enterprise_linux_for_power_little_endian_eus
- enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
- enterprise_linux_for_arm_64_eus
- enterprise_linux_for_arm_64
- enterprise_linux_for_ibm_z_systems_eus
- enterprise_linux_for_power_little_endian
- enterprise_linux_server_aus
- enterprise_linux_update_services_for_sap_solutions
- enterprise_linux
nixos
- nixos
archlinux
- arch_linux
almalinux
- almalinux
samba
- rsync
tritondatacenter
- smartos
suse
- suse_linux
gentoo
- linux