CVE-2018-5764: High severity Samba rsync vulnerability
Last updated 25 August 2025
Other sources
The parsearguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers to bypass an argument-sanitization protection mechanism.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rsyncto a version that resolves this vulnerability.Fixed in 3.2.3-4+deb11u1Fixed in 3.2.3-4+deb11u4Fixed in 3.2.7-1+deb12u6Fixed in 3.2.7-1+deb12u5Fixed in 3.4.1+ds1-5+deb13u4Fixed in 3.4.1+ds1-5+deb13u3Fixed in 3.4.4+ds1-1 - Upgrade
Upgrade
rsync/rsyncdto a version that resolves this vulnerability.Fixed in 3.1.3
Event History
Frequently Asked Questions
What is CVE-2018-5764?
CVE-2018-5764 is a vulnerability in the rsync software before version 3.1.3 that allows remote attackers to bypass an argument-sanitization protection mechanism by using multiple --protect-args options.
What software is affected by CVE-2018-5764?
CVE-2018-5764 affects Samba Rsync, Debian Debian Linux versions 7.0, 8.0, and 9.0, and Canonical Ubuntu Linux versions 14.04, 16.04, and 17.10.
What is the severity of CVE-2018-5764?
The severity of CVE-2018-5764 is high, with a CVSS score of 7.5.
How can I fix CVE-2018-5764?
To fix CVE-2018-5764, update rsync to version 3.1.3 or higher.
Where can I find more information about CVE-2018-5764?
You can find more information about CVE-2018-5764 at the following references: [SecurityFocus](http://www.securityfocus.com/bid/102803), [SecurityTracker](http://www.securitytracker.com/id/1040276), [Samba Rsync News](https://download.samba.org/pub/rsync/src-previews/rsync-3.1.3pre1-NEWS).