FS#75486 : [security] [rsync] CVE-2022-29154

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!

FS#75486 - [security] [rsync] CVE-2022-29154

Attached to Project: Arch Linux
Opened by T.J. Townsend (blakkheim) - Tuesday, 02 August 2022, 03:19 GMT
Last edited by Christian Hesse (eworm) - Thursday, 04 August 2022, 10:12 GMT

Task Type	Bug Report
Category	Packages: Extra
Status	Closed
Assigned To	Jelle van der Waa (jelly) Christian Hesse (eworm)
Architecture	All
Severity	High
Priority	Normal
Reported Version
Due in Version	Undecided
Due Date	Undecided
Percent Complete
Votes	1 Amin Vakil (aminvakil) (2022-08-02)
Private	No

Details

Description:
The rsync package is vulnerable to CVE-2022-29154, which is not yet in a non-preview release. The attached diff applies the upstream commit to fix it.

Additional info:
https://rsync.samba.org/ftp/rsync/NEWS#SECURITY_FIXES-3.2.5
https://github.com/WayneD/rsync/commit/b7231c7d02cfb65d291af74ff66e7d8c507ee871

rsync.diff (1.1 KiB)

This task depends upon

Closed by Christian Hesse (eworm)
Thursday, 04 August 2022, 10:12 GMT
Reason for closing: Fixed
Additional comments about closing: rsync 3.2.4-2