CVE-2022-29154

MITRE NVD CVE.ORG Print: PDF PDF

Summary

CVECVE-2022-29154
StatePUBLIC
Assigner[email protected]
Source PriorityCVE Program / NVD first with legacy fallback
Published2022-08-02 15:15:00 UTC
Updated2023-11-07 03:45:00 UTC
DescriptionAn issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).

Risk And Classification

Problem Types: CWE-20

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Fedoraproject Fedora 35 All All All
Operating System Fedoraproject Fedora 36 All All All
Application Samba Rsync All All All All

References

ReferenceSourceLinkTags
[SECURITY] Fedora 36 Update: rsync-3.2.5-1.fc36 - package-announce - Fedora Mailing-Lists lists.fedoraproject.org
[SECURITY] Fedora 36 Update: rsync-3.2.5-1.fc36 - package-announce - Fedora Mailing-Lists FEDORA lists.fedoraproject.org
oss-security - CVE-2022-29154: Rsync client-side arbitrary file write vulnerability. MLIST www.openwall.com
[SECURITY] Fedora 35 Update: rsync-3.2.5-1.fc35 - package-announce - Fedora Mailing-Lists FEDORA lists.fedoraproject.org
[SECURITY] Fedora 35 Update: rsync-3.2.5-1.fc35 - package-announce - Fedora Mailing-Lists lists.fedoraproject.org
Tags · WayneD/rsync · GitHub MISC github.com
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Legacy QID Mappings

  • 160058 Oracle Enterprise Linux Security Update for rsync (ELSA-2022-6170)
  • 160067 Oracle Enterprise Linux Security Update for rsync (ELSA-2022-6180)
  • 160069 Oracle Enterprise Linux Security Update for rsync (ELSA-2022-6181)
  • 184745 Debian Security Update for rsync (CVE-2022-29154)
  • 199215 Ubuntu Security Notification for rsync Vulnerabilities (USN-5921-1)
  • 240626 Red Hat Update for rsync (RHSA-2022:6170)
  • 240627 Red Hat Update for rsync (RHSA-2022:6181)
  • 240635 Red Hat Update for rsync (RHSA-2022:6171)
  • 240637 Red Hat Update for rsync (RHSA-2022:6180)
  • 240638 Red Hat Update for rsync (RHSA-2022:6172)
  • 257192 CentOS Security Update for rsync (CESA-2022:6170)
  • 283050 Fedora Security Update for rsync (FEDORA-2022-25e4dbedf9)
  • 283075 Fedora Security Update for rsync (FEDORA-2022-15da0cf165)
  • 296086 Oracle Solaris 11.4 Support Repository Update (SRU) 51.132.1 Missing (CPUOCT2022)
  • 354112 Amazon Linux Security Advisory for rsync : ALAS2-2022-1873
  • 354390 Amazon Linux Security Advisory for rsync : ALAS2022-2022-158
  • 354438 Amazon Linux Security Advisory for rsync : ALAS2022-2022-148
  • 355190 Amazon Linux Security Advisory for rsync : ALAS2023-2023-002
  • 377070 Alibaba Cloud Linux Security Update for rsync (ALINUX2-SA-2022:0037)
  • 377137 Alibaba Cloud Linux Security Update for rsync (ALINUX3-SA-2022:0153)
  • 502472 Alpine Linux Security Update for rsync
  • 502474 Alpine Linux Security Update for rsync
  • 504365 Alpine Linux Security Update for rsync
  • 672167 EulerOS Security Update for rsync (EulerOS-SA-2022-2448)
  • 672208 EulerOS Security Update for rsync (EulerOS-SA-2022-2479)
  • 672299 EulerOS Security Update for rsync (EulerOS-SA-2022-2664)
  • 672316 EulerOS Security Update for rsync (EulerOS-SA-2022-2696)
  • 672372 EulerOS Security Update for rsync (EulerOS-SA-2022-2777)
  • 672394 EulerOS Security Update for rsync (EulerOS-SA-2022-2742)
  • 690915 Free Berkeley Software Distribution (FreeBSD) Security Update for rsync (21f43976-1887-11ed-9911-40b034429ecf)
  • 752469 SUSE Enterprise Linux Security Update for rsync (SUSE-SU-2022:2825-1)
  • 752488 SUSE Enterprise Linux Security Update for rsync (SUSE-SU-2022:2859-1)
  • 752489 SUSE Enterprise Linux Security Update for rsync (SUSE-SU-2022:2858-1)
  • 752530 SUSE Enterprise Linux Security Update for rsync (SUSE-SU-2022:2959-1)
  • 902665 Common Base Linux Mariner (CBL-Mariner) Security Update for rsync (10462)
  • 902666 Common Base Linux Mariner (CBL-Mariner) Security Update for rsync (10461)
  • 903862 Common Base Linux Mariner (CBL-Mariner) Security Update for rsync (10461-1)
  • 904745 Common Base Linux Mariner (CBL-Mariner) Security Update for rsync (10462-1)
  • 940642 AlmaLinux Security Update for rsync (ALSA-2022:6180)
  • 960166 Rocky Linux Security Update for rsync (RLSA-2022:6180)
  • 960589 Rocky Linux Security Update for rsync (RLSA-2022:6181)
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report