CyberRota Analysis
AI-GeneratedRsync versions prior to 3.5.0 are vulnerable to a newline injection flaw in the uid/gid mapping interface, allowing local attackers to manipulate protocol messages by crafting user or group names with newline characters. This can lead to the corruption of uid/gid mapping logic, potentially allowing unauthorized access or privilege escalation. Organizations using affected versions should prioritize patching to mitigate the risk of local exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.