CVE-2026-43617

4.8 Moyenne

Publiée le 20/05/2026 à 04:16 · Modifiée le 24/07/2026 à 11:10 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
4.0	6.3 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	4.8 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-289

Références

https://github.com/RsyncProject/rsync/releases/tag/v3.4.3 Release Notes
https://github.com/RsyncProject/rsync/security/advisories/GHSA-rjfm-3w2m-jf4f Vendor Advisory
https://www.vulncheck.com/advisories/rsync-authorization-bypass-via-hostname-resolution Third Party Advisory

CVE-2026-43617

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs