Fcasal

**Name of the Vulnerable Software and Affected Versions** rsync versions prior to 3.5.0 **Description** Improper path handling allows a malicious sender to expand the scope of `--delete` operations beyond the intended destination subtree. By sending a crafted file list, an attacker can cause the receiver to reclassify implied parent directory entries or treat synthetic paths as the transfer root. This can be achieved through multiple methods, including implied parent reclassification, synthetic root path construction, non-directory root handling, and legacy protocol behavior below version 30, ultimately resulting in the deletion of files outside the authorized destination directory. **Recommendations** Update rsync to version 3.5.0 or later.

**Name of the Vulnerable Software and Affected Versions** rsync versions prior to 3.5.0 **Description** An arbitrary file write issue exists where attackers can write files outside the intended destination tree. This occurs by specifying an absolute path through the `--temp-dir` or `--link-dest` options, which bypasses the rename-confinement logic. This allows attacker-controlled values to write files to any location accessible to the rsync process. **Recommendations** Update rsync to version 3.5.0 or later.

**Name of the Vulnerable Software and Affected Versions** rsync versions prior to 3.5.0 **Description** A symlink race condition exists in the `--remove-source-files` feature. This occurs when an attacker with symlink creation access atomically substitutes a symlink for a source file between the completion of the transfer and the `unlink()` function call. This action causes the software to delete the symlink target instead of the intended source file, leading to arbitrary file deletion. **Recommendations** Update to version 3.5.0 or later. As a temporary mitigation, avoid using the `--remove-source-files` feature.

**Name of the Vulnerable Software and Affected Versions** rsync versions 3.4.2 through 3.4.x **Description** A denial of service issue exists where a remote sender can exhaust system resources on the receiver. This occurs because the short alias `--zt` for the `--compress-threads` option bypasses the string matching of the refuse options directive, which only checks long option names. An attacker can provide a large value for the `--zt` variable to spawn an unbounded number of Zstandard worker threads, leading to the exhaustion of available memory and thread resources. **Recommendations** Update rsync to version 3.5.0.