CVE-2014-2855

NameCVE-2014-2855
DescriptionThe check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a user name which does not exist in the secrets file.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs744791

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
rsync (PTS)jessie, jessie (lts)3.1.1-3+deb8u2fixed
stretch (security), stretch (lts), stretch3.1.2-1+deb9u3fixed
buster3.1.3-6fixed
bullseye3.2.3-4+deb11u1fixed
bookworm3.2.7-1fixed
sid, trixie3.3.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
rsyncsourcesqueeze(not affected)
rsyncsourcewheezy(not affected)
rsyncsource(unstable)3.1.0-3744791

Notes

[wheezy] - rsync <not-affected> (Introduced in 3.1.0)
[squeeze] - rsync <not-affected> (Introduced in 3.1.0)
Introduced with https://git.samba.org/?p=rsync.git;a=commitdiff;h=5ebe9a46d7f3c846a6d665cb8c6ab8b79508a6df
Fix: https://git.samba.org/?p=rsync.git;a=commitdiff;h=0dedfbce2c1b851684ba658861fe9d620636c56a

Search for package or bug name: Reporting problems