PT-2026-42051
CVE-2026-43617
·
Published
2026-05-20
·
Updated
2026-10-02
Description by
CVSS 4.0
6.3
MediumMetricsAV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
rsync versions prior to 3.4.3
Description
An authorization bypass exists in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record (a DNS record that maps an IP address to a hostname) for their source IP address. This allows connections from hostnames that administrators intended to deny in scenarios where reverse DNS resolution fails and defaults to UNKNOWN.
Recommendations
Update to version 3.4.3 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾