Medium severity · published Jan 14, 2025
CVE-2024-12086
Rsync: rsync server leaks arbitrary client files
6.8
CVSS
1.8%
EPSS
No
On KEV
Description
A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Discovery 2 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 6 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 9 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 9.6 Extended Update Support · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat OpenShift Container Platform 4 · Red Hat
All versions, or not specified · source: vendor
AL
Almalinux · Almalinux
8.0; 9.0; 10.0 · source: NVD
AL
Arch Linux · Archlinux
All versions, or not specified · source: NVD
EL
Enterprise Linux · Redhat
6.0; 7.0; 8.0; 9.0; 10.0 · source: NVD
LI
Linux · Gentoo
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-12086
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-12086
access.redhat.com
https://access.redhat.com/errata/RHBA-2025:6470
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:19368
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:20603
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:29197
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2024-12086
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2330577
More from Red Hat Discovery 2
10.0
CVE-2026-42043
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
9.9
CVE-2025-62718
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
9.8
CVE-2026-42010
Gnutls: gnutls: authentication bypass via nul character in username
9.8
CVE-2026-39892
cryptography has a buffer overflow if non-contiguous buffers were passed to APIs
9.8
CVE-2026-29063
Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable
