DEBIAN-CVE-2024-12086
Record from OSV · Published January 14, 2025
A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| rsync | Debian:14 | 3.3.0+ds1-3 |
| rsync | Debian:12 | 3.2.7-1+deb12u1 |
| rsync | Debian:13 | 3.3.0+ds1-3 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Debian:14 | rsync | 0 |
| Debian:12 | rsync | 0, 3.2.7-1 |
| Debian:13 | rsync | 0 |
Timeline
- Jan 14, 2025 CVE Published
- Sep 15, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln DEBIAN-CVE-2024-12086
vulnetix vdb fixes DEBIAN-CVE-2024-12086Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/DEBIAN-CVE-2024-12086/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart