VDB
RHSA-2025%3A1123
RHSA-2025%3A1123
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-operator-sdk-rhel9@sha256:a773937982aa37ef645253e2e6e2d9c38fb4d9a8da0acb151f662fc382ec4536_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | *, *, * |
| Red Hat | openshift4/ose-ansible-rhel9-operator@sha256:d383dd8a2a04d05692eb8d49731267d19742830fee9ec5ea342312b105514961_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | *, *, * |
| Red Hat | openshift4/ose-operator-sdk-rhel9@sha256:71841389668e11dba445b37c6c029f6ef4be3041e23ef00c722074176504094e_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-operator-sdk-rhel9@sha256:71841389668e11dba445b37c6c029f6ef4be3041e23ef00c722074176504094e_ppc64le |
| Red Hat | openshift4/ose-ansible-rhel9-operator@sha256:6d7dd4dd58b1a5ef415ae096e8aa099441bd47fb6bb04f152262bb8b2e656a3d_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | *, *, * |
| Red Hat | openshift4/ose-ansible-rhel9-operator@sha256:6d7dd4dd58b1a5ef415ae096e8aa099441bd47fb6bb04f152262bb8b2e656a3d_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-ansible-rhel9-operator@sha256:6d7dd4dd58b1a5ef415ae096e8aa099441bd47fb6bb04f152262bb8b2e656a3d_amd64 |
| Red Hat | openshift4/ose-ansible-rhel9-operator@sha256:d383dd8a2a04d05692eb8d49731267d19742830fee9ec5ea342312b105514961_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-ansible-rhel9-operator@sha256:d383dd8a2a04d05692eb8d49731267d19742830fee9ec5ea342312b105514961_ppc64le |
| Red Hat | openshift4/ose-operator-sdk-rhel9@sha256:71841389668e11dba445b37c6c029f6ef4be3041e23ef00c722074176504094e_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | *, *, * |
| Red Hat | openshift4/ose-helm-rhel9-operator@sha256:fc509614d7dfdb900a81bb08b6665672adedd411d428498f6367baab3f0561e5_s390x as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-helm-rhel9-operator@sha256:fc509614d7dfdb900a81bb08b6665672adedd411d428498f6367baab3f0561e5_s390x |
| Red Hat | openshift4/ose-ansible-rhel9-operator@sha256:7889b56b7aa50c9f5cf82d28e107e6fd65374a25dd146056868e84619d3b14f4_s390x as a component of Red Hat OpenShift Container Platform 4.16 | *, *, * |
| Red Hat | openshift4/ose-helm-rhel9-operator@sha256:0247f2a1d25885c1299c2002266144a2120c21882dfed20e79e7496512e476c4_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | *, *, * |
| Red Hat | openshift4/ose-ansible-rhel9-operator@sha256:47669c93d758474f9e9520aff26ecce659f8d736cd3cde046f9556f8dbc758fa_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | *, *, * |
| Red Hat | openshift4/ose-ansible-rhel9-operator@sha256:47669c93d758474f9e9520aff26ecce659f8d736cd3cde046f9556f8dbc758fa_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-ansible-rhel9-operator@sha256:47669c93d758474f9e9520aff26ecce659f8d736cd3cde046f9556f8dbc758fa_arm64 |
| Red Hat | openshift4/ose-helm-rhel9-operator@sha256:d9d23d3913086cd73b2b684adf3a87f5c34bdc2a1c9b41bc15fc97cca7ad6abb_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-helm-rhel9-operator@sha256:d9d23d3913086cd73b2b684adf3a87f5c34bdc2a1c9b41bc15fc97cca7ad6abb_arm64 |
| Red Hat | openshift4/ose-helm-rhel9-operator@sha256:cf512da56bb27aeb194b38b7792029286285e19e904788984a058eb596779539_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | *, *, * |
| Red Hat | openshift4/ose-helm-rhel9-operator@sha256:0247f2a1d25885c1299c2002266144a2120c21882dfed20e79e7496512e476c4_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-helm-rhel9-operator@sha256:0247f2a1d25885c1299c2002266144a2120c21882dfed20e79e7496512e476c4_ppc64le |
| Red Hat | openshift4/ose-ansible-rhel9-operator@sha256:7889b56b7aa50c9f5cf82d28e107e6fd65374a25dd146056868e84619d3b14f4_s390x as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-ansible-rhel9-operator@sha256:7889b56b7aa50c9f5cf82d28e107e6fd65374a25dd146056868e84619d3b14f4_s390x |
| Red Hat | openshift4/ose-operator-sdk-rhel9@sha256:37690f2e992b25784a7e50395b718e8186cb52484ed25dfbf49a3ad26a62de63_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | *, *, * |
| Red Hat | openshift4/ose-helm-rhel9-operator@sha256:cf512da56bb27aeb194b38b7792029286285e19e904788984a058eb596779539_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-helm-rhel9-operator@sha256:cf512da56bb27aeb194b38b7792029286285e19e904788984a058eb596779539_amd64 |
| Red Hat | openshift4/ose-operator-sdk-rhel9@sha256:a773937982aa37ef645253e2e6e2d9c38fb4d9a8da0acb151f662fc382ec4536_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
…and 6 more
Timeline
- Feb 12, 2025 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Jul 19, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:1123 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2330539 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2333122 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2333854 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2333856 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1123.json advisory
- https://access.redhat.com/security/cve/CVE-2024-12085 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-12085 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-12085 advisory
- https://kb.cert.org/vuls/id/952657 advisory
- https://access.redhat.com/security/cve/CVE-2024-45338 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-45338 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45338 advisory
- https://go.dev/cl/637536 advisory
- https://go.dev/issue/70906 advisory
- https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ advisory
- https://pkg.go.dev/vuln/GO-2024-3333 advisory
- https://access.redhat.com/security/cve/CVE-2024-56201 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-56201 advisory
…and 10 more