Debian Package Tracker
Register | Log in
Subscribe

rsync

fast, versatile, remote (and local) file-copying tool

Choose email to subscribe with

general
  • source: rsync (main)
  • version: 3.4.3+ds1-2
  • maintainer: Samuel Henrique (DMD)
  • uploaders: Paul Slootman [DMD]
  • arch: any
  • std-ver: 4.7.0
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • o-o-stable: 3.2.3-4+deb11u1
  • o-o-sec: 3.2.3-4+deb11u4
  • oldstable: 3.2.7-1+deb12u4
  • old-sec: 3.2.7-1+deb12u5
  • stable: 3.4.1+ds1-5+deb13u2
  • stable-sec: 3.4.1+ds1-5+deb13u3
  • testing: 3.4.2+ds1-2
  • unstable: 3.4.3+ds1-2
versioned links
  • 3.2.3-4+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 3.2.3-4+deb11u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 3.2.7-1+deb12u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 3.2.7-1+deb12u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 3.4.1+ds1-5+deb13u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 3.4.1+ds1-5+deb13u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 3.4.2+ds1-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 3.4.3+ds1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 3.4.3+ds1-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • rsync (74 bugs: 0, 36, 38, 0)
action needed
6 security issues in forky high

There are 6 open security issues in forky.

6 important issues:
  • CVE-2026-29518: Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.
  • CVE-2026-43617: Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.
  • CVE-2026-43618: Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.
  • CVE-2026-43619: Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.
  • CVE-2026-43620: Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted entry is not the leading dot directory, followed by a transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client.
  • CVE-2026-45232: Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.
Created: 2026-05-20 Last update: 2026-05-21 05:00
lintian reports 1 warning normal
Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.
Created: 2026-04-30 Last update: 2026-04-30 05:00
1 low-priority security issue in trixie low

There is 1 open security issue in trixie.

1 issue left for the package maintainer to handle:
  • CVE-2026-45232: (needs triaging) Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-05-20 Last update: 2026-05-21 05:00
1 low-priority security issue in bookworm low

There is 1 open security issue in bookworm.

1 issue left for the package maintainer to handle:
  • CVE-2026-45232: (needs triaging) Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-05-20 Last update: 2026-05-21 05:00
debian/patches: 2 patches to forward upstream low

Among the 4 debian patches available in version 3.4.3+ds1-2 of the package, we noticed the following issues:

  • 2 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.
Created: 2023-02-26 Last update: 2026-05-20 08:00
Standards version of the package is outdated. wishlist
The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.0).
Created: 2025-02-21 Last update: 2026-05-20 07:30
testing migrations
  • This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
  • excuses:
    • Migration status for rsync (3.4.2+ds1-2 to 3.4.3+ds1-2): BLOCKED: Rejected/violates migration policy/introduces a regression
    • Issues preventing migration:
    • ∙ ∙ Autopkgtest for apache2/2.4.67-1: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for autopkgtest/5.55: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
    • ∙ ∙ Autopkgtest for cod-tools/3.12.0+dfsg-1: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
    • ∙ ∙ Autopkgtest for cross-toolchain-base/80: amd64: Failed (not a regression) ♻ (reference ♻), arm64: Failed (not a regression) ♻ (reference ♻), i386: Failed (not a regression) ♻ (reference ♻), ppc64el: Failed (not a regression) ♻ (reference ♻), riscv64: Test triggered, s390x: Failed (not a regression) ♻ (reference ♻)
    • ∙ ∙ Autopkgtest for cyrus-imapd/3.12.2-1: amd64: Pass, arm64: Test triggered (failure will be ignored), i386: Failed (not a regression) ♻ (reference ♻), ppc64el: Pass, riscv64: Test triggered, s390x: Pass
    • ∙ ∙ Autopkgtest for debci/4.0.1: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
    • ∙ ∙ Autopkgtest for debmirror/1:2.48: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
    • ∙ ∙ Autopkgtest for deltarpm/3.6.5+dfsg-3: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
    • ∙ ∙ Autopkgtest for dgit/15.8: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for dired-rsync/0.7-3: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
    • ∙ ∙ Autopkgtest for distrobuilder/3.3.1-2: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
    • ∙ ∙ Autopkgtest for fdroidserver/2.4.4-1: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
    • ∙ ∙ Autopkgtest for git-annex/10.20251029-1: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
    • ∙ ∙ Autopkgtest for git-filter-repo/2.47.0-3: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
    • ∙ ∙ Autopkgtest for greenbone-feed-sync/25.2.0-2: amd64: No tests, superficial or marked flaky ♻, arm64: No tests, superficial or marked flaky ♻, i386: No tests, superficial or marked flaky ♻, ppc64el: No tests, superficial or marked flaky ♻, riscv64: Test triggered, s390x: No tests, superficial or marked flaky ♻
    • ∙ ∙ Autopkgtest for grml2usb/0.20.13: amd64: No tests, superficial or marked flaky ♻, arm64: No tests, superficial or marked flaky ♻, i386: No tests, superficial or marked flaky ♻, ppc64el: No tests, superficial or marked flaky ♻, riscv64: Test triggered, s390x: No tests, superficial or marked flaky ♻
    • ∙ ∙ Autopkgtest for gsocket/1.4.43-4: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for ikiwiki-hosting/0.20220717-2: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for incus/7.0.0-1: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for ironic-python-agent/11.5.0-2: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for lava/2026.02-3: amd64: Pass, arm64: Pass, i386: Failed (not a regression) ♻ (reference ♻), ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for lib1305/0~20250415-4: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for lib25519/0~20241004-6: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for libfile-rsync-perl/0.49-4: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for libguestfs/1:1.58.1-5: amd64: Pass, arm64: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for lilypond/2.24.4-6: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for lxc/1:7.0.0-1: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for mariadb/1:11.8.6-6: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for mhddfs/0.1.39.0-1: amd64: No tests, superficial or marked flaky ♻, arm64: No tests, superficial or marked flaky ♻, i386: No tests, superficial or marked flaky ♻, ppc64el: No tests, superficial or marked flaky ♻, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for nagios-plugins-rabbitmq/1:2.0.3-1: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for node-jest/29.6.2~ds5+~cs73.45.28-2: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for node-rimraf/4.4.1-6: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for node-yaml/2.8.3+~cs0.4.0-1: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for nova/2:33.0.1-1: amd64: Pass, arm64: Pass, i386: No tests, superficial or marked flaky ♻, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for parsyncfp2/2.59+git20250602.e687b9f-1: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for repopush/0.1.0-4: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for restfuldb/0.16.0+dfsg-1.1: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for rsnapshot/1.5.1-1: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for rsync/3.4.3+ds1-2: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for ruby-rsync/1.0.9-3: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for swift/2.37.1-3: amd64: Regression ♻ (reference ♻), arm64: Failed (not a regression) ♻ (reference ♻), i386: No tests, superficial or marked flaky ♻, ppc64el: Failed (not a regression) ♻ (reference ♻), riscv64: Test triggered, s390x: Test triggered (failure will be ignored)
    • ∙ ∙ Autopkgtest for tinyssh/20260401-1: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for toil/9.3.0-3: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for underscore/1.13.8~dfsg+~1.13.0-1: amd64: No tests, superficial or marked flaky ♻, arm64: No tests, superficial or marked flaky ♻, i386: No tests, superficial or marked flaky ♻, ppc64el: No tests, superficial or marked flaky ♻, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for yarsync/0.3.3-1: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Autopkgtest for zsh-syntax-highlighting/0.8.0-2: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
    • ∙ ∙ Too young, only 1 of 2 days old
    • Additional info (not blocking):
    • ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/r/rsync.html
    • ∙ ∙ Reproduced on amd64 - info
    • ∙ ∙ Reproduced on arm64 - info
    • ∙ ∙ Reproduced on armhf - info
    • ∙ ∙ Reproduced on i386 - info
    • Not considered
news
[rss feed]
  • [2026-05-20] Accepted rsync 3.2.3-4+deb11u4 (source amd64) into oldoldstable-security (Thorsten Alteholz)
  • [2026-05-20] Accepted rsync 3.4.1+ds1-5+deb13u3 (source) into stable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
  • [2026-05-20] Accepted rsync 3.2.7-1+deb12u5 (source) into oldstable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
  • [2026-05-20] Accepted rsync 3.4.3+ds1-2 (source) into unstable (Samuel Henrique)
  • [2026-05-20] Accepted rsync 3.4.3+ds1-1 (source) into unstable (Samuel Henrique)
  • [2026-05-07] Accepted rsync 3.4.1+ds1-5+deb13u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Samuel Henrique)
  • [2026-05-07] rsync 3.4.2+ds1-2 MIGRATED to testing (Debian testing watch)
  • [2026-04-30] Accepted rsync 3.4.2+ds1-2 (source) into unstable (Samuel Henrique)
  • [2026-04-29] Accepted rsync 3.4.2+ds1-1 (source) into unstable (Samuel Henrique)
  • [2026-04-04] Accepted rsync 3.4.1+ds1-8~exp1 (source) into experimental (Samuel Henrique)
  • [2025-12-27] Accepted rsync 3.2.7-1+deb12u4 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Samuel Henrique)
  • [2025-12-26] Accepted rsync 3.2.7-1+deb12u3 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Samuel Henrique)
  • [2025-12-22] Accepted rsync 3.4.1+ds1-5+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Samuel Henrique)
  • [2025-11-30] rsync 3.4.1+ds1-7 MIGRATED to testing (Debian testing watch)
  • [2025-11-28] Accepted rsync 3.4.1+ds1-7 (source) into unstable (Matheus Polkorny) (signed by: Samuel Henrique)
  • [2025-10-28] rsync 3.4.1+ds1-6 MIGRATED to testing (Debian testing watch)
  • [2025-10-22] Accepted rsync 3.4.1+ds1-6 (source) into unstable (Samuel Henrique)
  • [2025-07-30] rsync 3.4.1+ds1-5 MIGRATED to testing (Debian testing watch)
  • [2025-07-26] Accepted rsync 3.4.1+ds1-5 (source) into unstable (Alex) (signed by: Samuel Henrique)
  • [2025-07-06] Accepted rsync 3.4.1+ds1-5~exp1 (source) into experimental (Alex) (signed by: Samuel Henrique)
  • [2025-06-20] rsync 3.4.1+ds1-4 MIGRATED to testing (Debian testing watch)
  • [2025-06-09] Accepted rsync 3.4.1+ds1-4 (source) into unstable (Samuel Henrique)
  • [2025-06-08] Accepted rsync 3.4.1+ds1-4~exp2 (source) into experimental (Alex) (signed by: Samuel Henrique)
  • [2025-06-05] Accepted rsync 3.4.1+ds1-4~exp1 (source) into experimental (Alex) (signed by: Samuel Henrique)
  • [2025-03-17] rsync 3.4.1+ds1-3 MIGRATED to testing (Debian testing watch)
  • [2025-03-07] Accepted rsync 3.4.1+ds1-3 (source) into unstable (Arnaud Rebillout)
  • [2025-03-07] Accepted rsync 3.4.1+ds1-2 (source) into unstable (Arnaud Rebillout)
  • [2025-03-05] Accepted rsync 3.4.1+ds1-1 (source) into unstable (Arnaud Rebillout)
  • [2025-01-17] Accepted rsync 3.2.3-4+deb11u3 (source) into oldstable-security (Thorsten Alteholz)
  • [2025-01-17] Accepted rsync 3.2.7-1+deb12u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Samuel Henrique)
  • 1
  • 2
bugs [bug history graph]
  • all: 67 74
  • RC: 0
  • I&N: 33 36
  • M&W: 34 38
  • F&P: 0
  • patch: 0
links
  • homepage
  • lintian (0, 1)
  • buildd: logs, reproducibility, cross
  • popcon
  • browse source code
  • other distros
  • security tracker
  • debian patches
  • debci
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 3.4.1+ds1-7
  • 18 bugs (1 patch)

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing