Executive brief
Rsync is a widely used utility for synchronizing files between systems. A security flaw in the rsync server (daemon) allows unauthorized users to bypass access restrictions that are based on hostnames. This could allow an attacker to connect to a file share they were intended to be blocked from, potentially leading to unauthorized data access or modification.
Technical details
An authorization bypass exists in rsync versions prior to 3.4.3 when the rsync daemon is configured to use a chroot. The vulnerability occurs because reverse DNS lookups for connecting clients are performed after the process has entered the chroot environment. If the chroot lacks necessary system configuration files (such as /etc/resolv.conf or NSS modules), the lookup fails and defaults the hostname to 'UNKNOWN'. An attacker who controls the PTR record for their source IP can exploit this failure to bypass 'hosts deny' rules that target specific hostnames. This allows connections from hosts that administrators intended to block, though IP-based ACLs remain effective.
Affected products
- RsyncProject rsync < 3.4.3
Timeline
- 2026-05-19: disclosed
- 2026-05-20: patched: Fixed in version 3.4.3
- 2026-05-20: advisory