mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-07-26 07:07:08 +00:00
Code Issues Projects Releases Wiki Activity

rsync: fix CVE-2024-12088

Browse Source 
A flaw was found in rsync. When using the `--safe-links` option, rsync fails to
properly verify if a symbolic link destination contains another symbolic link within it.
This results in a path traversal vulnerability, which may lead to arbitrary file write
outside the desired directory.

(From OE-Core rev: dad4a83c011310872cce07fc4141e66a98439cb1)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Archana Polampalli
2025-01-16 15:15:08 +00:00
committed by Steve Sakoman
parent 6158711198
commit 78e33c0f8b
2 changed files with 142 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-devtools/rsync/rsync_3.2.7.bb
+1
View File
@@ -25,6 +25,7 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \
file://CVE-2024-12087-0001.patch \
file://CVE-2024-12087-0002.patch \
file://CVE-2024-12087-0003.patch \
file://CVE-2024-12088.patch \
"
SRC_URI[sha256sum] = "4e7d9d3f6ed10878c58c5fb724a67dacf4b6aac7340b13e488fb2dc41346f2bb"