Path to this page:
Subject: CVS commit: pkgsrc/net/rsync
From: Thomas Klausner
Date: 2025-01-14 20:30:05
Message id: 20250114193005.999FCFC1D@cvs.NetBSD.org
Log Message:
rsync: update to 3.4.0.
Release 3.4.0 is a security release that fixes a number of important vulnerabilities.
For more details on the vulnerabilities please see the CERT report
https://kb.cert.org/vuls/id/952657
## Changes in this version:
### PROTOCOL NUMBER:
- The protocol number was changed to 32 to make it easier for
administrators to check their servers have been updated
### SECURITY FIXES:
Many thanks to Simon Scannell, Pedro Gallegos, and Jasiel Spelman at
Google Cloud Vulnerability Research and Aleksei Gorban (Loqpa) for
discovering these vulnerabilities and working with the rsync project
to develop and test fixes.
- CVE-2024-12084 - Heap Buffer Overflow in Checksum Parsing.
- CVE-2024-12085 - Info Leak via uninitialized Stack contents defeats ASLR.
- CVE-2024-12086 - Server leaks arbitrary client files.
- CVE-2024-12087 - Server can make client write files outside of destination \
directory using symbolic links.
- CVE-2024-12088 - --safe-links Bypass.
- CVE-2024-12747 - symlink race condition.
### BUG FIXES:
- Fixed the included popt to avoid a memory error on modern gcc versions.
- Fixed an incorrect extern variable's type that caused an ACL issue on macOS.
- Fixed IPv6 configure check
### INTERNAL:
- Updated included popt to version 1.19.
### DEVELOPER RELATED:
- Various improvements to the release scripts and git setup.
- Improved packaging/var-checker to identify variable type issues.
- added FreeBSD and Solaris CI builds
Files: