LiveActive security incident?Get immediate response
CVE Record

CVE-2024-12087: Rsync: path traversal vulnerability in rsync

A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.

MediumCVSS 6.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2024-12087 lets a malicious rsync server cause a client to write files outside the folder the client intended. This can affect systems that pull backups, mirrors, or software content from rsync servers. The rated severity is medium, but business impact can be significant where rsync runs with broad file permissions.

Executive priority

Prioritize patching where rsync pulls data into sensitive servers, build systems, backup hosts, or privileged automation. Treat internet or third-party rsync sources as higher urgency. Lower priority may be reasonable for systems that do not run rsync clients or only sync from trusted internal servers.

Technical view

This is a CWE-22 path traversal issue in rsync tied to --inc-recursive behavior. Inadequate symlink verification and per-file-list deduplication checks can let a server write files outside the client destination directory. CVSS is 6.5: network reachable, low complexity, no privileges, user interaction required, high integrity impact.

Likely exposure

Exposure is most relevant to clients that connect to untrusted or compromised rsync servers. The bundle lists affected Red Hat Enterprise Linux 6 ELS, 7 ELS, 8, 9, 10, Red Hat Discovery 1.14, and OpenShift Container Platform 4 rhcos packages. Other vendors may be affected; check their advisories.

Exploitation context

The attacker needs the victim to run rsync as a client against a malicious server. The CVE is not listed as KEV in the provided data, so active exploitation is not established here. A Google security advisory is referenced, indicating public technical detail exists.

Researcher notes

Key conditions are client-side rsync operation, --inc-recursive behavior, server-controlled file lists, symlink handling, and destination escape. The provided data does not prove arbitrary code execution or confidentiality impact. Validate product status through vendor advisories because affected packaging differs by distribution and platform.

Mitigation direction

  • Apply relevant vendor rsync updates, including applicable Red Hat RHSA or RHBA errata.
  • For non-Red Hat systems, check CERT and vendor advisories for fixed package guidance.
  • Avoid pulling rsync content from untrusted servers until systems are updated.
  • Review automated backup, mirror, and deployment jobs that use rsync clients.

Validation and detection

  • Inventory systems with rsync installed, especially Red Hat and OpenShift environments listed as affected.
  • Compare installed package versions against the vendor CVE page and errata.
  • Identify rsync jobs that pull from external, third-party, or less-trusted servers.
  • Confirm updates were installed through standard package or platform compliance reporting.
Prepared
Confidence
high
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-22: File access and web shell behavior lookup

File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

File access behavior lookup

The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
description · low confidence lookup

Container behavior lookup

The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-12087 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
5Timeline events
2ADP providers
21Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.5CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N2.83.6redhat

Vulnerability scoring details

Base CVSS 3.1 score

6.5Medium
CVSS 3.1 vector shape for CVE-2024-12087Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. Source timelineredhat

    Reported to Red Hat.

  3. Source timelineredhat

    Made public.

  4. CVE publishedCVE Program

    The CVE record was published.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Unknown vendorrsyncrsync, 0unaffected
Red HatRed Hat Enterprise Linux 10rsync, 0:3.4.1-2.el10affected
Red HatRed Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSIONrsync, 0:3.0.6-12.el6_10.2affected
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Supportrsync, 0:3.1.2-12.el7_9.2affected
Red HatRed Hat Enterprise Linux 8rsync, 0:3.1.3-21.el8_10affected
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Supportrsync, 0:3.1.3-7.el8_2.6affected
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportrsync, 0:3.1.3-12.el8_4.6affected
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onrsync, 0:3.1.3-12.el8_4.6affected
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportrsync, 0:3.1.3-14.el8_6.9affected
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Servicersync, 0:3.1.3-14.el8_6.9affected
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutionsrsync, 0:3.1.3-14.el8_6.9affected
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Servicersync, 0:3.1.3-20.el8_8.4affected
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutionsrsync, 0:3.1.3-20.el8_8.4affected
Red HatRed Hat Enterprise Linux 9rsync, 0:3.2.5-3.el9affected
Red HatRed Hat Enterprise Linux 9rsync, 0:3.2.5-3.el9affected
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutionsrsync, 0:3.2.3-9.el9_0.4affected
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutionsrsync, 0:3.2.3-19.el9_2.2affected
Red HatRed Hat Enterprise Linux 9.4 Extended Update Supportrsync, 0:3.2.3-19.el9_4.2affected
Red HatRed Hat Discovery 1.14discovery/discovery-ui-rhel9, 1.14.2-1748467619affected
Red HatRed Hat OpenShift Container Platform 4rhcosaffected
Weakness

CWE details

CWE-22

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.