mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-07-26 07:07:08 +00:00
Code Issues Projects Releases Wiki Activity

rsync: fix CVE-2024-12086

Browse Source 
A flaw was found in rsync. It could allow a server to enumerate the contents of an
arbitrary file from the client's machine. This issue occurs when files are being
copied from a client to a server. During this process, the rsync server will send
checksums of local data to the client to compare with in order to determine what
data needs to be sent to the server. By sending specially constructed checksum values
for arbitrary files, an attacker may be able to reconstruct the data of those files
byte-by-byte based on the responses from the client.

(From OE-Core rev: 19f4e7bd965c63f19cc756e6e2bf8f58d9e1dc8d)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Archana Polampalli
2025-01-16 15:15:06 +00:00
committed by Steve Sakoman
parent b8832293c5
commit dfbd3aac89
5 changed files with 303 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-devtools/rsync/rsync_3.2.7.bb
+4
View File
@@ -18,6 +18,10 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \
file://CVE-2024-12084-0001.patch \
file://CVE-2024-12084-0002.patch \
file://CVE-2024-12085.patch \
file://CVE-2024-12086-0001.patch \
file://CVE-2024-12086-0002.patch \
file://CVE-2024-12086-0003.patch \
file://CVE-2024-12086-0004.patch \
"
SRC_URI[sha256sum] = "4e7d9d3f6ed10878c58c5fb724a67dacf4b6aac7340b13e488fb2dc41346f2bb"