7.5

CVE-2024-12085

Exploit

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.

Data is provided by the National Vulnerability Database (NVD)
Samba ≫ Rsync Version < 3.3.0
Redhat ≫ Openshift Version5.0
Redhat ≫ Enterprise Linux Version8.0
Redhat ≫ Enterprise Linux Version9.0
Redhat ≫ Enterprise Linux Eus Version8.8
Redhat ≫ Enterprise Linux Eus Version9.2
Redhat ≫ Enterprise Linux Eus Version9.4
Redhat ≫ Enterprise Linux Eus Version9.6
Redhat ≫ Enterprise Linux For Arm 64 Version8.0_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Version9.0_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Version9.2_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Eus Version8.8_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Eus Version9.4_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Eus Version9.6_aarch64
Almalinux ≫ Almalinux Version8.0 Update-
Almalinux ≫ Almalinux Version9.0 Update-
Almalinux ≫ Almalinux Version10.0 Update-
Archlinux ≫ Arch Linux Version-
Gentoo ≫ Linux Version-
Nixos ≫ Nixos Version < 24.11
Suse ≫ Suse Linux Version-
Tritondatacenter ≫ Smartos Version < 20250123
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 9.67% 0.926
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
secalert@redhat.com 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-908 Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

https://bugzilla.redhat.com/show_bug.cgi?id=2330539
Third Party Advisory
Issue Tracking