Debian ships a major rsync upgrade to fix 33 CVEs

Debian's rsync maintainer, Samuel Henrique, has announced that the trixie-security package jumps straight to rsync 3.5.0, up from 3.4.1. The reason is a batch of 33 CVEs. In his judgement, bumping the whole version carried less risk than backporting every patch individually: he analysed the extra changes the new release brings and concluded they were safer than a pile of manual fixes.

The main warning is aimed at administrators: the update changes behavior, and those changes stem from the fixes themselves rather than from the version bump as such. The full list lives in NEWS.md.gz, but the most likely breakers are spelled out in the changelog.

Symlinks are no longer trusted

The key change: operator-supplied paths are no longer followed through untrusted symlinks. The destination directory and the arguments to a long list of options — from --backup-dir and --temp-dir to --files-from, --exclude-from and filter merge files — are now resolved one component at a time. A symlink is followed only if owned by root or by the user running rsync; one owned by anyone else is refused with "refusing to follow a symlink owned by an untrusted user". The old behavior returns with --insecure-links, but only locally — a daemon never honours it. For a single trusted module, set insecure links = yes instead.

Restricted rrsync and permissions

The rrsync wrapper now refuses --debug on every invocation, and when confined to a subdirectory it additionally denies --copy-unsafe-links and stops uploads from creating devices or special files. The --chmod=a+s option now sets both the setuid and setgid bits, matching chmod(1), where it previously set setuid alone.

Who gets through to the daemon

Several rsyncd access rules changed in ways that alter who is admitted. proxy protocol = true without a proxy protocol hosts list now rejects every connection instead of blindly trusting a client-supplied PROXY header. hosts deny now fails closed when a hostname cannot be resolved. The auth users handling and hosts allow/hosts deny matching now follow the documentation more strictly, and --compress-threads is capped at 8. Finally, rsync-ssl now verifies the server certificate and binds it to the requested hostname.

Source: Lobsters