From: Slackware Security Team <security@slackware.com>
To: slackware-security@slackware.com
Subject: [slackware-security] rsync (SSA:2022-227-01)
Date: Mon, 15 Aug 2022 13:27:07 -0700 (PDT)





-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security] rsync (SSA:2022-227-01)

New rsync packages are available for Slackware 14.0, 14.1, 14.2, 15.0,
and -current to fix a security issue.


Here are the details from the Slackware 15.0 ChangeLog:
+--------------------------+
patches/packages/rsync-3.2.5-i586-1_slack15.0.txz: Upgraded.
Added some file-list safety checking that helps to ensure that a rogue
sending rsync can't add unrequested top-level names and/or include recursive
names that should have been excluded by the sender. These extra safety
checks only require the receiver rsync to be updated. When dealing with an
untrusted sending host, it is safest to copy into a dedicated destination
directory for the remote content (i.e. don't copy into a destination
directory that contains files that aren't from the remote host unless you
trust the remote host).
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29154
(* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/rsync-3.2.5-i486-1_slack14.0.txz

Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/rsync-3.2.5-x86_64-1_slack14.0.txz

Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/rsync-3.2.5-i486-1_slack14.1.txz

Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/rsync-3.2.5-x86_64-1_slack14.1.txz

Updated package for Slackware 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/rsync-3.2.5-i586-1_slack14.2.txz

Updated package for Slackware x86_64 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/rsync-3.2.5-x86_64-1_slack14.2.txz

Updated package for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/rsync-3.2.5-i586-1_slack15.0.txz

Updated package for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/rsync-3.2.5-x86_64-1_slack15.0.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/rsync-3.2.5-i586-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/rsync-3.2.5-x86_64-1.txz


MD5 signatures:
+-------------+

Slackware 14.0 package:
3f0ca0f8ed464ca170fde81edaa2c805 rsync-3.2.5-i486-1_slack14.0.txz

Slackware x86_64 14.0 package:
100660633045818b403259797ebe2aa3 rsync-3.2.5-x86_64-1_slack14.0.txz

Slackware 14.1 package:
dd89e119220509baf81a56c176e497a0 rsync-3.2.5-i486-1_slack14.1.txz

Slackware x86_64 14.1 package:
698dfde7b2c3a6a9d7b2b39206c5bf24 rsync-3.2.5-x86_64-1_slack14.1.txz

Slackware 14.2 package:
d330a2802b454e88b29a3c52686cc06e rsync-3.2.5-i586-1_slack14.2.txz

Slackware x86_64 14.2 package:
366f07d475fae2645d6c446207e5327b rsync-3.2.5-x86_64-1_slack14.2.txz

Slackware 15.0 package:
81f90b336a233c240c5ed3a7e54635f9 rsync-3.2.5-i586-1_slack15.0.txz

Slackware x86_64 15.0 package:
70a01b72fc4e502650b952ab2e336e93 rsync-3.2.5-x86_64-1_slack15.0.txz

Slackware -current package:
45eb531038158b16250c63c370f8a994 n/rsync-3.2.5-i586-1.txz

Slackware x86_64 -current package:
d67bac8495b92af8160ea7c4b8ed79b3 n/rsync-3.2.5-x86_64-1.txz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg rsync-3.2.5-i586-1_slack15.0.txz


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list: |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back containing instructions to |
| complete the process. Please do not reply to this email address. |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----

iEYEARECAAYFAmL6q7IACgkQakRjwEAQIjP/UQCgjFtWhQaNVmNGeUnAbf59hL1+
X8wAnRFkph/0lVf+t7UMYjjyWTWwrJRj
=fqCn
-----END PGP SIGNATURE-----