CyberRota Analysis
AI-GeneratedOpenSSL versions used in rsync 3.2.0 to 3.2.3 and rsync-ssl through 3.4.4 are vulnerable to a TLS certificate validation flaw, enabling on-path attackers to intercept and manipulate encrypted sessions by presenting invalid certificates. This vulnerability allows attackers to bypass certificate validation, potentially leading to unauthorized access to sensitive data during rsync operations. Organizations utilizing these versions of rsync should prioritize patching to mitigate the risk of session hijacking and data compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to validate server TLS certificates against a trusted CA or verify certificate hostname matching to decrypt or tamper with rsync session content without detection by the client.