CVE-2024-12086

Published Jan 14, 2025

Last updated a month ago

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2024-12086 is an information leak vulnerability in the rsync file transfer utility. When a client copies files to a server, the server sends checksums to the client for comparison. By manipulating these checksums, a malicious server can deduce the contents of arbitrary files on the client machine, effectively reconstructing them byte by byte. This vulnerability occurs when files are being copied from a client to a server. Rsync is a commonly used tool for transferring files and directories both locally and remotely, often employed for deployments and backups. It works by transferring only the changed or missing files, enabling efficient synchronization across different locations. This vulnerability affects the client-server interaction during file transfers.

Description: A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client.
Source: secalert@redhat.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 6.1
Impact score: 4
Exploitability score: 1.6
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Severity: MEDIUM

Weaknesses

secalert@redhat.com: CWE-390

Hype score: Not currently trending

Overview

AI description

Risk scores

CVSS 3.1

Weaknesses

Social media

References