This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2018-5764 →

DEBIAN-CVE-2018-5764

The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers...

Original description

The description as published by the source.

The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers to bypass an argument-sanitization protection mechanism.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 rsync

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2.2"}]}]

Debian:13 rsync

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2.2"}]}]

Debian:14 rsync

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2.2"}]}]

References

advisory security-tracker.debian.org