> Anonymous read access to a rsync server... such as on a public mirror
I did not know people did that.
Rsync vulnerabilities
21–27 of 27 posts
Re: Rsync vulnerabilities
#22Are these applicable to the openrsync project?
Openbsd do unsurprisingly have higher standards for code quality.
Re: Rsync vulnerabilities
#23Slackware sent a fixed version of rsync out yesterday. But I wonder of OpenBSD's openrsync has the same issue ? Or did that version avoid the issues when it was created ? If it was avoided, seems OpenBSD was ahead of the curve again.
Given the more permissive license openrsync would be in a pickle if they stole the vulnerable GPL code and claimed to redistribute it under BSD license instead of reimplementing the protocol.
Which is highly unlikely to happen in openbsd.
Re: Rsync vulnerabilities
#24Do I read correctly that this is related to "rsync daemon" (rsyncd), and therefore has minimal impact on people who just use rsync over ssh?
[dead]
Re: Rsync vulnerabilities
#25There's a serious regression in the fixes: https://github.com/RsyncProject/rsync/issues/702 It impacts those who need to use `-r` (recursive) together with `-H` (preserve hardlinks),
Fix was merged an hour ago, roughly an hour after you made this comment (at which time they were still working on it)
There's another one:
https://github.com/RsyncProject/rsync/issues/715
Re: Rsync vulnerabilities
#26> Anonymous read access to a rsync server... such as on a public mirror I did not know people did that.
For a concrete example: https://www.gentoo.org/support/rsync-mirrors/
Gentoo's package manager most typically updates over rsync.