CVE-2020-14387
First published: Thu Sep 03 2020(Updated: )
A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/rsync | <3.2.4 | 3.2.4 |
| Samba Rsync | >=3.2.1<3.2.4 | |
| Samba Rsync | =3.2.0 | |
| Samba Rsync | =3.2.0-pre1 | |
| Samba Rsync | =3.2.0-pre2 | |
| Samba Rsync | =3.2.0-pre3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1875549
- https://git.samba.org/?p=rsync.git;a=commit;h=c3f7414
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1875550
- https://access.redhat.com/security/cve/cve-2020-14387
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1875549#c5
- https://download.samba.org/pub/rsync/NEWS#3.2.4
Frequently Asked Questions
What is CVE-2020-14387?
CVE-2020-14387 is a vulnerability in rsync versions since 3.2.0pre1 that allows a remote, unauthenticated attacker to perform a man-in-the-middle attack using a valid certificate for another hostname.
What is the severity of CVE-2020-14387?
The severity of CVE-2020-14387 is high, with a CVSS score of 7.4.
How does CVE-2020-14387 affect rsync?
CVE-2020-14387 affects rsync versions since 3.2.0pre1.
How can CVE-2020-14387 be fixed?
To fix CVE-2020-14387, update rsync to version 3.2.4 or later.
Where can I find more information about CVE-2020-14387?
You can find more information about CVE-2020-14387 at the following references: [Reference 1](https://bugzilla.redhat.com/show_bug.cgi?id=1875549), [Reference 2](https://git.samba.org/?p=rsync.git;a=commit;h=c3f7414), [Reference 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1875550).
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/references
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-14387
- agent/software-canonical-lookup
- agent/severity
- agent/remedy
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/description
- agent/tags
- agent/event
- agent/trending
- vendor/samba
- canonical/samba rsync
- version/samba rsync/3.2.1
- version/samba rsync/3.2.0
- version/samba rsync/3.2.0-pre1
- version/samba rsync/3.2.0-pre2
- version/samba rsync/3.2.0-pre3
- package-manager/redhat