Security update for rsync SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:2959-2 Final 1 1 2022-08-31T11:10:34Z current 2022-08-31T11:10:34Z 2022-08-31T11:10:34Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for rsync This update for rsync fixes the following issues: - CVE-2022-29154: Fixed an arbitrary file write issue that could be triggered by a malicious remote server (bsc#1201840). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/sle-micro-rancher/5.2:latest-2022-2959,Image SLES15-SP1-SAP-Azure-LI-BYOS-Production-2022-2959,Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production-2022-2959,Image SLES15-SP1-SAPCAL-Azure-2022-2959,Image SLES15-SP1-SAPCAL-EC2-HVM-2022-2959,Image SLES15-SP1-SAPCAL-GCE-2022-2959,Image SLES15-SP2-BYOS-Azure-2022-2959,Image SLES15-SP2-BYOS-EC2-HVM-2022-2959,Image SLES15-SP2-BYOS-GCE-2022-2959,Image SLES15-SP2-HPC-BYOS-Azure-2022-2959,Image SLES15-SP2-HPC-BYOS-EC2-HVM-2022-2959,Image SLES15-SP2-SAP-Azure-2022-2959,Image SLES15-SP2-SAP-Azure-LI-BYOS-Production-2022-2959,Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production-2022-2959,Image SLES15-SP2-SAP-BYOS-Azure-2022-2959,Image SLES15-SP2-SAP-BYOS-EC2-HVM-2022-2959,Image SLES15-SP2-SAP-BYOS-GCE-2022-2959,Image SLES15-SP2-SAP-EC2-HVM-2022-2959,Image SLES15-SP2-SAP-GCE-2022-2959,Image SLES15-SP3-BYOS-Azure-2022-2959,Image SLES15-SP3-BYOS-EC2-HVM-2022-2959,Image SLES15-SP3-BYOS-GCE-2022-2959,Image SLES15-SP3-HPC-BYOS-Azure-2022-2959,Image SLES15-SP3-HPC-BYOS-EC2-HVM-2022-2959,Image SLES15-SP3-HPC-BYOS-GCE-2022-2959,Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure-2022-2959,Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM-2022-2959,Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE-2022-2959,Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure-2022-2959,Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM-2022-2959,Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE-2022-2959,Image SLES15-SP3-Micro-5-1-BYOS-Azure-2022-2959,Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM-2022-2959,Image SLES15-SP3-Micro-5-1-BYOS-GCE-2022-2959,Image SLES15-SP3-Micro-5-2-BYOS-Azure-2022-2959,Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM-2022-2959,Image SLES15-SP3-Micro-5-2-BYOS-GCE-2022-2959,Image SLES15-SP3-SAP-Azure-LI-BYOS-Production-2022-2959,Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production-2022-2959,Image SLES15-SP3-SAP-BYOS-Azure-2022-2959,Image SLES15-SP3-SAP-BYOS-EC2-HVM-2022-2959,Image SLES15-SP3-SAP-BYOS-GCE-2022-2959,Image SLES15-SP3-SAPCAL-Azure-2022-2959,Image SLES15-SP3-SAPCAL-EC2-HVM-2022-2959,Image SLES15-SP3-SAPCAL-GCE-2022-2959,SUSE-2022-2959,openSUSE-Leap-Micro-5.2-2022-2959 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20222959-2/ Link for SUSE-SU-2022:2959-2 https://lists.suse.com/pipermail/sle-security-updates/2022-September/012056.html E-Mail link for SUSE-SU-2022:2959-2 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1201840 SUSE Bug 1201840 https://www.suse.com/security/cve/CVE-2022-29154/ SUSE CVE CVE-2022-29154 page Container suse/sle-micro-rancher/5.2:latest Image SLES15-SP1-SAP-Azure-LI-BYOS-Production Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production Image SLES15-SP1-SAPCAL-Azure Image SLES15-SP1-SAPCAL-EC2-HVM Image SLES15-SP1-SAPCAL-GCE Image SLES15-SP2-BYOS-Azure Image SLES15-SP2-BYOS-EC2-HVM Image SLES15-SP2-BYOS-GCE Image SLES15-SP2-HPC-BYOS-Azure Image SLES15-SP2-HPC-BYOS-EC2-HVM Image SLES15-SP2-SAP-Azure Image SLES15-SP2-SAP-Azure-LI-BYOS-Production Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production Image SLES15-SP2-SAP-BYOS-Azure Image SLES15-SP2-SAP-BYOS-EC2-HVM Image SLES15-SP2-SAP-BYOS-GCE Image SLES15-SP2-SAP-EC2-HVM Image SLES15-SP2-SAP-GCE Image SLES15-SP3-BYOS-Azure Image SLES15-SP3-BYOS-EC2-HVM Image SLES15-SP3-BYOS-GCE Image SLES15-SP3-HPC-BYOS-Azure Image SLES15-SP3-HPC-BYOS-EC2-HVM Image SLES15-SP3-HPC-BYOS-GCE Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE Image SLES15-SP3-Micro-5-1-BYOS-Azure Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM Image SLES15-SP3-Micro-5-1-BYOS-GCE Image SLES15-SP3-Micro-5-2-BYOS-Azure Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM Image SLES15-SP3-Micro-5-2-BYOS-GCE Image SLES15-SP3-SAP-Azure-LI-BYOS-Production Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production Image SLES15-SP3-SAP-BYOS-Azure Image SLES15-SP3-SAP-BYOS-EC2-HVM Image SLES15-SP3-SAP-BYOS-GCE Image SLES15-SP3-SAPCAL-Azure Image SLES15-SP3-SAPCAL-EC2-HVM Image SLES15-SP3-SAPCAL-GCE openSUSE Leap Micro 5.2 rsync-3.1.3-150000.4.13.1 rsync-3.1.3-150000.4.13.1 as a component of Container suse/sle-micro-rancher/5.2:latest rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP1-SAP-Azure-LI-BYOS-Production rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP1-SAPCAL-Azure rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP1-SAPCAL-EC2-HVM rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP1-SAPCAL-GCE rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP2-BYOS-Azure rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP2-BYOS-EC2-HVM rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP2-BYOS-GCE rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP2-HPC-BYOS-Azure rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP2-HPC-BYOS-EC2-HVM rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP2-SAP-Azure rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP2-SAP-Azure-LI-BYOS-Production rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP2-SAP-BYOS-Azure rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP2-SAP-BYOS-EC2-HVM rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP2-SAP-BYOS-GCE rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP2-SAP-EC2-HVM rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP2-SAP-GCE rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-BYOS-Azure rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-BYOS-EC2-HVM rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-BYOS-GCE rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-HPC-BYOS-Azure rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-HPC-BYOS-EC2-HVM rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-HPC-BYOS-GCE rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-Micro-5-1-BYOS-Azure rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-Micro-5-1-BYOS-GCE rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-Micro-5-2-BYOS-Azure rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-Micro-5-2-BYOS-GCE rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-SAP-Azure-LI-BYOS-Production rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-SAP-BYOS-Azure rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-SAP-BYOS-EC2-HVM rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-SAP-BYOS-GCE rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-SAPCAL-Azure rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-SAPCAL-EC2-HVM rsync-3.1.3-150000.4.13.1 as a component of Image SLES15-SP3-SAPCAL-GCE rsync-3.1.3-150000.4.13.1 as a component of openSUSE Leap Micro 5.2 An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file). CVE-2022-29154 Container suse/sle-micro-rancher/5.2:latest:rsync-3.1.3-150000.4.13.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:rsync-3.1.3-150000.4.13.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:rsync-3.1.3-150000.4.13.1 Image SLES15-SP1-SAPCAL-Azure:rsync-3.1.3-150000.4.13.1 Image SLES15-SP1-SAPCAL-EC2-HVM:rsync-3.1.3-150000.4.13.1 Image SLES15-SP1-SAPCAL-GCE:rsync-3.1.3-150000.4.13.1 Image SLES15-SP2-BYOS-Azure:rsync-3.1.3-150000.4.13.1 Image SLES15-SP2-BYOS-EC2-HVM:rsync-3.1.3-150000.4.13.1 Image SLES15-SP2-BYOS-GCE:rsync-3.1.3-150000.4.13.1 Image SLES15-SP2-HPC-BYOS-Azure:rsync-3.1.3-150000.4.13.1 Image SLES15-SP2-HPC-BYOS-EC2-HVM:rsync-3.1.3-150000.4.13.1 Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:rsync-3.1.3-150000.4.13.1 Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:rsync-3.1.3-150000.4.13.1 Image SLES15-SP2-SAP-Azure:rsync-3.1.3-150000.4.13.1 Image SLES15-SP2-SAP-BYOS-Azure:rsync-3.1.3-150000.4.13.1 Image SLES15-SP2-SAP-BYOS-EC2-HVM:rsync-3.1.3-150000.4.13.1 Image SLES15-SP2-SAP-BYOS-GCE:rsync-3.1.3-150000.4.13.1 Image SLES15-SP2-SAP-EC2-HVM:rsync-3.1.3-150000.4.13.1 Image SLES15-SP2-SAP-GCE:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-BYOS-Azure:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-BYOS-EC2-HVM:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-BYOS-GCE:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-HPC-BYOS-Azure:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-HPC-BYOS-EC2-HVM:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-HPC-BYOS-GCE:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-Micro-5-1-BYOS-Azure:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-Micro-5-1-BYOS-GCE:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-Micro-5-2-BYOS-Azure:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-Micro-5-2-BYOS-GCE:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-SAP-Azure-LI-BYOS-Production:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-SAP-BYOS-Azure:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-SAP-BYOS-EC2-HVM:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-SAP-BYOS-GCE:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-SAPCAL-Azure:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-SAPCAL-EC2-HVM:rsync-3.1.3-150000.4.13.1 Image SLES15-SP3-SAPCAL-GCE:rsync-3.1.3-150000.4.13.1 openSUSE Leap Micro 5.2:rsync-3.1.3-150000.4.13.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222959-2/ https://www.suse.com/security/cve/CVE-2022-29154.html CVE-2022-29154 https://bugzilla.suse.com/1201840 SUSE Bug 1201840 https://bugzilla.suse.com/1202970 SUSE Bug 1202970 https://bugzilla.suse.com/1202998 SUSE Bug 1202998 https://bugzilla.suse.com/1203401 SUSE Bug 1203401 https://bugzilla.suse.com/1203789 SUSE Bug 1203789 https://bugzilla.suse.com/1204119 SUSE Bug 1204119 https://bugzilla.suse.com/1205072 SUSE Bug 1205072