CVE-2020-14387: High severity samba vulnerability
A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.
Other sources
In rsync > 3.2.0pre1, rsync-ssl does not verify the hostname in the server certificate in openssl mode, so a man-in-the-middle attacker with a valid certificate for another hostname could intercept connections.
Upstream patch: https://git.samba.org/?p=rsync.git;a=commit;h=c3f7414
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-14387?
CVE-2020-14387 is a vulnerability in rsync versions since 3.2.0pre1 that allows a remote, unauthenticated attacker to perform a man-in-the-middle attack using a valid certificate for another hostname.
What is the severity of CVE-2020-14387?
The severity of CVE-2020-14387 is high, with a CVSS score of 7.4.
How does CVE-2020-14387 affect rsync?
CVE-2020-14387 affects rsync versions since 3.2.0pre1.
How can CVE-2020-14387 be fixed?
To fix CVE-2020-14387, update rsync to version 3.2.4 or later.
Where can I find more information about CVE-2020-14387?
You can find more information about CVE-2020-14387 at the following references: [Reference 1](https://bugzilla.redhat.com/show_bug.cgi?id=1875549), [Reference 2](https://git.samba.org/?p=rsync.git;a=commit;h=c3f7414), [Reference 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1875550).