CVE-2024-12747
Full vulnerability record from the local CVENow database.
Description
A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.
Severity
MEDIUM
CVSS score
5.6
(v3.1)
Vulnerability status
Deferred
Source identifier
Published
2025-01-14 18:15:25.830000
Last modified
2026-10-21 21:17:29.383000
View original CVE JSON
{
"id": "CVE-2024-12747",
"sourceIdentifier": "[email protected]",
"published": "2025-01-14T18:15:25.830",
"lastModified": "2026-10-21T21:17:29.383",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation."
},
{
"lang": "es",
"value": "Se encontró un fallo en rsync. Esta vulnerabilidad surge de una condición de ejecución durante la gestión de enlaces simbólicos por parte de rsync. El comportamiento predeterminado de rsync cuando encuentra enlaces simbólicos es omitirlos. Si un atacante reemplazaba un archivo normal con un enlace simbólico en el momento adecuado, era posible omitir el comportamiento predeterminado y atravesar los enlaces simbólicos. Según los privilegios del proceso rsync, un atacante podría filtrar información confidencial, lo que podría llevar a una escalada de privilegios."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"defaultStatus": "unaffected",
"collectionURL": "https://github.com/RsyncProject/rsync",
"packageName": "rsync",
"versions": [
{
"version": "0",
"lessThanOrEqual": "3.3.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rsync",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.0"
],
"versions": [
{
"version": "0:3.4.1-2.el10",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rsync",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8::baseos"
],
"versions": [
{
"version": "0:3.1.3-21.el8_10",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rsync",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
],
"versions": [
{
"version": "0:3.2.5-3.el9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rsync",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
],
"versions": [
{
"version": "0:3.2.5-3.el9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Discovery 1.14",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "discovery/discovery-ui-rhel9",
"cpes": [
"cpe:/a:redhat:discovery:1.14::el9"
],
"versions": [
{
"version": "1.14.2-1748467619",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"defaultStatus": "unknown",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rsync",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"defaultStatus": "unknown",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rsync",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift/ose-rhel-coreos-9",
"cpes": [
"cpe:/a:redhat:openshift:4"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.1,
"impactScore": 4.0
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-01-14T18:38:10.199669Z",
"id": "CVE-2024-12747",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-362"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHBA-2025:6470",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:2600",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:7050",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:8385",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-12747",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2332968",
"source": "[email protected]"
},
{
"url": "https://kb.cert.org/vuls/id/952657",
"source": "[email protected]"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00008.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250131-0002/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.kb.cert.org/vuls/id/952657",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
]
}