It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-148 advisory.

    A flaw was found in rsync that is triggered by a victim rsync user/client connecting to a malicious rsync     server. The server can copy and overwrite arbitrary files in the client's rsync target directory and     subdirectories. This flaw allows a malicious server, or in some cases, another attacker who performs a     man-in-the-middle attack, to potentially overwrite sensitive files on the client machine, resulting in     further exploitation. (CVE-2022-29154)

    A security vulnerability was found in zlib. The flaw triggered a heap-based buffer in inflate in the     inflate.c function via a large gzip header extra field. This flaw is only applicable in the call     inflateGetHeader. (CVE-2022-37434)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2022 : rsync, rsync-daemon (ALAS2022-2022-148)

critical Nessus Plugin ID 166125

Version 1.6