rsync hash_search() collisions let attackers exhaust sender CPU
The rsync file-sync server can be made to freeze its CPU by malicious requests.
Summary
A flaw in the hash_search() handling of rsync's sender lets a malicious receiver exhaust the server's CPU. rsync servers that offer a public daemon module are affected.
Affected when
- rsync daemon serving a public module
- rsync before 3.5.2
What to do
Update to rsync 3.5.2.
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab)
- Write-up: github.com (opens in a new tab) · vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen