Re:Rsync client-side arbitrary file write vulnerability
by ollien on Tuesday August 02, 2022 @10:36AM
(#32319043)
Maybe my sleuthing skills are lacking this morning, but is there a reported minimum affected version?
[ Parent
| on HN ]
Re:Rsync client-side arbitrary file write vulnerability
by ksbrooksjr on Tuesday August 02, 2022 @02:48PM
(#32322746)
It looks like versions prior to 3.2.5 are affected [1]. If you're using the version of rsync bundled with MacOS, then it's affected.
If you're not connecting to random malicious servers then this might not be a part of your threat model though. As long as your private keys are secure, and you've verified the public keys in your known_hosts file, then this exploit would be hard to take advantage of by a man in the middle attack. Basically, all of the normal security rules of the underlying SSH protocol apply here.