{"containers": {"cna": {"affected": [{"product": "rsync", "vendor": "n/a", "versions": [{"status": "affected", "version": "rsync 3.2.4"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-297", "description": "CWE-297", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-05-27T19:44:53", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1875549"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2020-14387", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "rsync", "version": {"version_data": [{"version_value": "rsync 3.2.4"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-297"}]}]}, "references": {"reference_data": [{"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1875549", "refsource": "MISC", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1875549"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T12:46:33.953Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1875549"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2020-14387", "datePublished": "2021-05-27T19:44:53", "dateReserved": "2020-06-17T00:00:00", "dateUpdated": "2024-08-04T12:46:33.953Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*", "matchCriteriaId": "45922B1C-D968-46DD-8EE6-F0B22F085733", "versionEndExcluding": "3.2.4", "versionStartIncluding": "3.2.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:samba:rsync:3.2.0:-:*:*:*:*:*:*", "matchCriteriaId": "E3E08234-5E6E-444D-B466-7FDADB951199", "vulnerable": true}, {"criteria": "cpe:2.3:a:samba:rsync:3.2.0:pre1:*:*:*:*:*:*", "matchCriteriaId": "D3FA9537-95CA-4B6D-8162-6DC5D4B0BD32", "vulnerable": true}, {"criteria": "cpe:2.3:a:samba:rsync:3.2.0:pre2:*:*:*:*:*:*", "matchCriteriaId": "06F27E32-CB3F-4140-AFBD-1A65031D42F5", "vulnerable": true}, {"criteria": "cpe:2.3:a:samba:rsync:3.2.0:pre3:*:*:*:*:*:*", "matchCriteriaId": "5EB9157B-D013-400A-A5F3-8088676586C8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4."}, {"lang": "es", "value": "Se encontr\u00f3 un fallo en rsync en versiones desde 3.2.0pre1. Rsync comprueba inapropiadamente el certificado con vulnerabilidad de discrepancia de host. Un atacante remoto no autenticado podr\u00eda explotar el fallo llevando a cabo un de tipo ataque de tipo man-in-the-middle usando un certificado v\u00e1lido para otro nombre de host que podr\u00eda comprometer la confidencialidad e integridad de los datos transmitidos usando rsync-ssl. La mayor amenaza de esta vulnerabilidad es la confidencialidad e integridad de los datos. Este fallo afecta a rsync versiones anteriores a 3.2.4"}], "id": "CVE-2020-14387", "lastModified": "2021-06-09T14:54:16.800", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-05-27T20:15:07.873", "references": [{"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1875549"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-297"}], "source": "secalert@redhat.com", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank Matt McCutchen for reporting this issue.", "bugzilla": {"description": "rsync: rsync-ssl does not verify the hostname in the server certificate when using openssl", "id": "1875549", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1875549"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-297", "details": ["A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.", "A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity."], "mitigation": {"lang": "en:us", "value": "This vulnerability can be mitigated by not using rsync-ssl in openssl mode."}, "name": "CVE-2020-14387", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "rsync", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "rsync", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "rsync", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "rsync", "product_name": "Red Hat Enterprise Linux 8"}], "public_date": "2020-09-03T18:10:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2020-14387\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-14387"], "threat_severity": "Important", "upstream_fix": "rsync 3.2.4"}