There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host
    mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-
    the-middle attack using a valid certificate for another hostname which could compromise confidentiality
    and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data
    confidentiality and integrity. This flaw affects rsync versions before 3.2.4. (CVE-2020-14387)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host
    mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-
    the-middle attack using a valid certificate for another hostname which could compromise confidentiality
    and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data
    confidentiality and integrity. This flaw affects rsync versions before 3.2.4. (CVE-2020-14387)

  - An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary
    files inside the directories of connecting peers. The server chooses which files/directories are sent to
    the client. However, the rsync client performs insufficient validation of file names. A malicious rsync
    server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory
    and subdirectories (for example, overwrite the .ssh/authorized_keys file). (CVE-2022-29154)

远程主机受到 GLSA-202405-22 中所述漏洞的影响（rsync：多种漏洞）

  - 如果输入具有许多远程匹配项，则 zlib 1.2.12 之前版本会在压缩时造成内存损坏。(CVE-2018-25032)

  - 在 3.2.0pre1 以上版本的 rsync 中发现一个缺陷。Rsync 未正确验证带有主机不匹配漏洞的证书。未经身份验证的远程攻击者可以通过使用其他主机名的有效证书执行中间人攻击来利用此缺陷，这可能会破坏使用 rsync-ssl 传输的数据的机密性和完整性。此漏洞最主要的威胁对象是数据机密性和完整性。此缺陷影响 3.2.4 之前的 rsync 版本。(CVE-2020-14387)

  - 在 3.2.5 之前的 rsync 中发现一个问题，该问题允许恶意远程服务器在连接的对等机目录内写入任意文件。服务器会选择将哪些文件/目录发送到客户端，但是，rsync 客户端未充分验证文件名。恶意 rsync 服务器（或中间人攻击者）可覆盖 rsync 客户端目标目录和子目录中的任意文件（例如覆盖 .ssh/authorized_keys 文件）。(CVE-2022-29154)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

遠端主機受到 GLSA-202405-22 中所述的弱點影響 (rsync：多個弱點)

  - 如果輸入包含許多遠端比對，zlib 1.2.12 更舊版本會在壓縮時允許造成記憶體損毀。(CVE-2018-25032)

  - 在 3.2.0pre1 之後的各個版本的 rsync 中發現缺陷。Rsync 不當驗證具有主機不相符弱點的憑證。未經驗證的遠端攻擊者可透過使用其他主機名稱的有效憑證執行攔截式攻擊來惡意利用此瑕疵，其可危害使用 rsync-ssl 傳輸之資料的機密性和完整性。此弱點對資料機密性與完整性的威脅最大。此瑕疵會影響 3.2.4 之前的 rsync 版本。(CVE-2020-14387)

  - 在 rsync 3.2.5 之前版本中發現一個問題，該問題允許惡意遠端伺服器在連線的對等端目錄中寫入任意檔案。伺服器會選擇將哪些檔案/目錄傳送至用戶端，但是，rsync 用戶端未對檔案名稱進行充分驗證。惡意 rsync 伺服器 (或攔截式攻擊者) 可覆寫 rsync 用戶端目標目錄和子目錄中的任意檔案 (例如覆寫 .ssh/authorized_keys 檔案)。(CVE-2022-29154)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

The remote host is affected by the vulnerability described in GLSA-202405-22 (rsync: Multiple Vulnerabilities)

  - zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many     distant matches. (CVE-2018-25032)

  - A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host     mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-     the-middle attack using a valid certificate for another hostname which could compromise confidentiality     and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data     confidentiality and integrity. This flaw affects rsync versions before 3.2.4. (CVE-2020-14387)

  - An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary     files inside the directories of connecting peers. The server chooses which files/directories are sent to     the client. However, the rsync client performs insufficient validation of file names. A malicious rsync     server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory     and subdirectories (for example, overwrite the .ssh/authorized_keys file). (CVE-2022-29154)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the rsync package has been released.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
406947	Alpine: rsync: security update to 0	Tenable Cloud Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	high
406947	Alpine: rsync: security update to 0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	high
406952	Alpine: rsync: security update to 3.2.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	high
406952	Alpine: rsync: security update to 3.2.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	high
195162	GLSA-202405-22：rsync：多个漏洞	Nessus	Gentoo Local Security Checks	2024/5/8	2024/5/8	high
195162	GLSA-202405-22：rsync：多個弱點	Nessus	Gentoo Local Security Checks	2024/5/8	2024/5/8	high
195162	GLSA-202405-22 : rsync: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2024/5/8	2024/5/8	high
150934	Photon OS 4.0: Rsync PHSA-2021-4.0-0046	Nessus	PhotonOS Local Security Checks	2021/6/21	2025/8/22	high

検出

プラグインの検索

high

high

high

high

high

high

high

high