- Announce - AlmaLinux List Archives

Rsync Vulnerabilities - Patching Status
by Jonathan Wright 18 Jan '25

18 Jan '25

Hello community, Security researchers at Google, namely Pedro Gallegos, Simon Scannell, and Jasiel Spelman, identified vulnerabilities in both the rsync server and client. These vulnerabilities range from extremely concerning to just annoying, and are at different stages of being patched. This blog post will be updated as patches are released by us. The Announcement The server vulnerabilities (CVE-2024-12084 <https://access.redhat.com/security/cve/CVE-2024-12084> and CVE-2024-12085 <https://access.redhat.com/security/cve/CVE-2024-12085>) can lead to remote code execution (RCE). On the client side, vulnerabilities allow a malicious server to read arbitrary files (CVE-2024-12086 <https://access.redhat.com/security/cve/CVE-2024-12086>), create unsafe symlinks (CVE-2024-12087 <https://access.redhat.com/security/cve/CVE-2024-12087>), and, under certain conditions, overwrite arbitrary files (CVE-2024-12088 <https://access.redhat.com/security/cve/CVE-2024-12088>). Additionally, during the coordinated response to these issues, Aleksei Gorban reported a sixth vulnerability (CVE-2024-12747 <https://access.redhat.com/security/cve/CVE-2024-12747>) related to how the rsync server manages symlinks. These vulnerabilities were responsibly disclosed to us through the CERT/CC Vulnerability Notes Database, ahead of the public disclosure <https://www.kb.cert.org/vuls/id/952657> on January 14, 2025. Impact and Mitigation:AlmaLinux OS 8 & AlmaLinux OS 9 AlmaLinux 8 and AlmaLinux 9 are vulnerable only to 5 of the 6 CVEs (CVE-2024-12085, CVE-2024-12086, CVE-2024-12087, CVE-2024-12088, and CVE-2024-12747). Red Hat has released patches addressing only CVE-2024-12085. That was promptly released for AlmaLinux 8 <https://errata.almalinux.org/8/ALSA-2025-0325.html> and AlmaLinux 9 <https://errata.almalinux.org/9/ALSA-2025-0324.html> as part of our normal patch and release workflow. We have also prepared packages with patches for the remaining vulnerabilities from upstream Rsync, but ALESCo is still discussing releasing those patches if Red Hat does not patch them. If these patches are important to you and your rsync use-cases please let ALESCo know in the ALESCo room on the AlmaLinux community chat <https://chat.almalinux.org/almalinux/channels/alesco>! Vulnerabilitiy Status - CVE-2024-12084 - Not Affected on AlmaLinux 8 or 9 - CVE-2024-12085 - Patched on AlmaLinux 8 and 9 - CVE-2024-12086 - Vulnerable on AlmaLinux 8 and 9 - CVE-2024-12087 - Vulnerable on AlmaLinux 8 and 9 - CVE-2024-12088 - Vulnerable on AlmaLinux 8 and 9 - CVE-2024-12747 - Vulnerable on AlmaLinux 8 and 9 Patched Packages (CVE-2024-12085) - rsync-3.1.3-20.el8_10.x86_64.rpm - rsync-3.1.3-20.el8_10.aarch64.rpm - rsync-3.1.3-20.el8_10.ppc64le.rpm - rsync-3.1.3-20.el8_10.s390x.rpm - rsync-daemon-3.1.3-20.el8_10.x86_64.rpm - rsync-daemon-3.1.3-20.el8_10.aarch64.rpm - rsync-daemon-3.1.3-20.el8_10.ppc64le.rpm - rsync-daemon-3.1.3-20.el8_10.s390x.rpm - rsync-3.2.3-20.el9_5.1.x86_64.rpm - rsync-3.2.3-20.el9_5.1.aarch64.rpm - rsync-3.2.3-20.el9_5.1.ppc64le.rpm - rsync-3.2.3-20.el9_5.1.s390x.rpm - rsync-daemon-3.2.3-20.el9_5.1.x86_64.rpm - rsync-daemon-3.2.3-20.el9_5.1.aarch64.rpm - rsync-daemon-3.2.3-20.el9_5.1.ppc64le.rpm - rsync-daemon-3.2.3-20.el9_5.1.s390x.rpm AlmaLinux OS Kitten 10 On January 14, 2025 we released an updated package for AlmaLinux OS Kitten 10 addressing all six vulnerabilities without waiting for patches to be included in CentOS Stream 10. If Red Hat chooses to only patch some of the vulnerabilities we will carry patches for all of the vulnerabilities within AlmaLinux Kitten 10 (which would be a deviation from Red Hat). Vulnerabilitiy Status - CVE-2024-12084 - Patched on AlmaLinux OS Kitten 10 - CVE-2024-12085 - Patched on AlmaLinux OS Kitten 10 - CVE-2024-12086 - Patched on AlmaLinux OS Kitten 10 - CVE-2024-12087 - Patched on AlmaLinux OS Kitten 10 - CVE-2024-12088 - Patched on AlmaLinux OS Kitten 10 - CVE-2024-12747 - Patched on AlmaLinux OS Kitten 10 Patched Packages - rsync-3.3.0-6.el10.alma.1.x86_64.rpm - rsync-3.3.0-6.el10.alma.1.x86_64_v2.rpm - rsync-3.3.0-6.el10.alma.1.aarch64.rpm - rsync-3.3.0-6.el10.alma.1.ppc64le.rpm - rsync-3.3.0-6.el10.alma.1.s390x.rpm - rsync-daemon-3.3.0-6.el10.alma.1.x86_64.rpm - rsync-daemon-3.3.0-6.el10.alma.1.x86_64_v2.rpm - rsync-daemon-3.3.0-6.el10.alma.1.aarch64.rpm - rsync-daemon-3.3.0-6.el10.alma.1.ppc64le.rpm - rsync-daemon-3.3.0-6.el10.alma.1.s390x.rpm AlmaLinx rsync Backport Package AlmaLinux maintains an optional Rsync package that is primarily used by AlmaLinux Mirror maintainers to allow for additional functionality and performance enhancements and is suggested for our mirrors <https://lists.almalinux.org/hyperkitty/list/mirror-announce@lists.almalinux…> . On January 14 we released updates for these backported rsync RPMs. rsync from this backport repo was at version 3.3.0, and we updated the repo to 3.4.0 and subsequently 3.4.1, as the updates were released upstream. Vulnerabilitiy Status - CVE-2024-12084 - Patched in rsync Backport Package - CVE-2024-12085 - Patched in rsync Backport Package - CVE-2024-12086 - Patched in rsync Backport Package - CVE-2024-12087 - Patched in rsync Backport Package - CVE-2024-12088 - Patched in rsync Backport Package - CVE-2024-12747 - Patched in rsync Backport Package Patched Packages - rsync-3.4.0-1.el8.x86_64.rpm (regressions fixed in rsync-3.4.1-1.el8.x86_64.rpm) - rsync-3.4.0-1.el9.x86_64.rpm (regressions fixed in rsync-3.4.1-1.el9.x86_64.rpm) - rsync-3.4.0-1.el8.aarch64.rpm (regressions fixed in rsync-3.4.1-1.el8.aarch64.rpm) - rsync-3.4.0-1.el9.aarch64.rpm (regressions fixed in rsync-3.4.1-1.el9.aarch64.rpm) - rsync-daemon-3.4.0-1.el8.x86_64.rpm (regressions fixed in rsync-daemon-3.4.1-1.el8.x86_64.rpm) - rsync-daemon-3.4.0-1.el9.x86_64.rpm (regressions fixed in rsync-daemon-3.4.1-1.el9.x86_64.rpm) - rsync-daemon-3.4.0-1.el8.aarch64.rpm (regressions fixed in rsync-daemon-3.4.1-1.el8.aarch64.rpm) - rsync-daemon-3.4.0-1.el9.aarch64.rpm (regressions fixed in rsync-daemon-3.4.1-1.el9.aarch64.rpm) Further updates We will update this blog post as future updates are available. Please also sign up for the AlmaLinux Announce mailing list <https://lists.almalinux.org/mailman3/lists/announce.lists.almalinux.org/> to make sure you don’t miss any updates. If you have any questions or concerns, feel free to reach out in our community chat <https://chat.almalinux.org>! -- Jonathan Wright AlmaLinux Foundation Mattermost: chat <https://chat.almalinux.org/almalinux/messages/@jonathan>

1 0

[Security Advisory] ALSA-2025:0312: raptor2 security update (Important)
by AlmaLinux Errata Notifications 15 Jan '25

15 Jan '25

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2025-01-15 Summary: Raptor is the RDF Parser Toolkit for Redland that provides a set of standalone RDF parsers, generating triples from RDF/XML or N-Triples. Security Fix(es): * raptor: integer underflow when normalizing a URI with the turtle parser (CVE-2024-57823) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2025-0312.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2025:0308: fence-agents security update (Important)
by AlmaLinux Errata Notifications 15 Jan '25

15 Jan '25

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2025-01-15 Summary: The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * fence-agents: Jinja has a sandbox breakout through indirect reference to format method [almalinux-9.5.z] (CVE-2024-56326) * fence-agents: Jinja has a sandbox breakout through malicious filenames [almalinux-9.5.z] (CVE-2024-56201) Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2025-0308.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2025:0324: rsync security update (Important)
by AlmaLinux Errata Notifications 15 Jan '25

15 Jan '25

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2025-01-15 Summary: The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es): * rsync: Info Leak via Uninitialized Stack Contents (CVE-2024-12085) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2025-0324.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2025:0325: rsync security update (Important)
by AlmaLinux Errata Notifications 15 Jan '25

15 Jan '25

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2025-01-15 Summary: The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es): * rsync: Info Leak via Uninitialized Stack Contents (CVE-2024-12085) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2025-0325.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2025:0314: raptor2 security update (Important)
by AlmaLinux Errata Notifications 15 Jan '25

15 Jan '25

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2025-01-15 Summary: Raptor is the RDF Parser Toolkit for Redland that provides a set of standalone RDF parsers, generating triples from RDF/XML or N-Triples. Security Fix(es): * raptor: integer underflow when normalizing a URI with the turtle parser (CVE-2024-57823) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2025-0314.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2025:0059: kernel security update (Important)
by AlmaLinux Errata Notifications 14 Jan '25

14 Jan '25

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2025-01-13 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: perf/aux: Fix AUX buffer serialization (CVE-2024-46713) * kernel: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (CVE-2024-50208) * kernel: mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address (CVE-2024-50252) * kernel: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (CVE-2024-53122) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2025-0059.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:11486: kernel security update (Moderate)
by AlmaLinux Errata Notifications 14 Jan '25

14 Jan '25

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2025-01-13 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (CVE-2024-27399) * kernel: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (CVE-2024-38564) * kernel: bpf: Fix a kernel verifier crash in stacksafe() (CVE-2024-45020) * kernel: nfsd: ensure that nfsd4_fattr_args.context is zeroed out (CVE-2024-46697) * kernel: bpf: Fix use-after-free in bpf_uprobe_multi_link_attach() (CVE-2024-47675) * kernel: bpf: Fix a sdiv overflow issue (CVE-2024-49888) * kernel: arm64: probes: Remove broken LDR (literal) uprobe support (CVE-2024-50099) * kernel: xfrm: fix one more kernel-infoleak in algo dumping (CVE-2024-50110) * kernel: Bluetooth: SCO: Fix UAF on sco_sock_timeout (CVE-2024-50125) * kernel: Bluetooth: ISO: Fix UAF on iso_sock_timeout (CVE-2024-50124) * kernel: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (CVE-2024-50115) * kernel: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (CVE-2024-50142) * kernel: Bluetooth: bnep: fix wild-memory-access in proto_unregister (CVE-2024-50148) * kernel: irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (CVE-2024-50192) * kernel: Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs (CVE-2024-50255) * kernel: sched/numa: Fix the potential null pointer dereference in task_numa_work() (CVE-2024-50223) * kernel: bpf: Fix out-of-bounds write in trie_get_next_key() (CVE-2024-50262) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2024-11486.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2025:0288: Bug fix of NetworkManager (Moderate)
by AlmaLinux Errata Notifications 14 Jan '25

14 Jan '25

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2025-01-13 Summary: Security and Bug Fix(es): * NetworkManager: DHCP routing options can manipulate interface-based VPN traffic (CVE-2024-3661) * Route to VPN server not stored in routing table that is specified by ipv4.route-table (JIRA:AlmaLinux-73051) * VPN connections do not support ipv4.routing-rules settings (JIRA:AlmaLinux-73052) Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2025-0288.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2025:0281: thunderbird security update (Important)
by AlmaLinux Errata Notifications 14 Jan '25

14 Jan '25

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2025-01-13 Summary: Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6 (CVE-2025-0243) * firefox: thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6 (CVE-2025-0242) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2025-0281.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0