summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/rsync/files
Commit message (Collapse)AuthorAgeFilesLines
* rsync: fix CVE-2024-12747Archana Polampalli2025-01-241-0/+192
| | | | | | | | | | | | | | A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation. (From OE-Core rev: c0905ffb2f1aa3bc4c6187ff4860dcc8d3dbfb01) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rsync: fix CVE-2024-12088Archana Polampalli2025-01-241-0/+141
| | | | | | | | | | | | A flaw was found in rsync. When using the `--safe-links` option, rsync fails to properly verify if a symbolic link destination contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory (From OE-Core rev: 741200c41a19ef5b4876d9a80667dfde2e5f4a9d) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rsync: fix CVE-2024-12087Archana Polampalli2025-01-243-0/+120
| | | | | | | | | | | | | | | | A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client. (From OE-Core rev: 12328df8dfcdc73ef70af299e9ebdc1d8ae73f37) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rsync: fix CVE-2024-12086Archana Polampalli2025-01-244-0/+299
| | | | | | | | | | | | | | | A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client. (From OE-Core rev: b49c8f58c20d7deb354a86a34488cb798c49eba3) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rsync: fix CVE-2024-12085Archana Polampalli2025-01-241-0/+32
| | | | | | | | | | | | A flaw was found in the rsync daemon which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time. (From OE-Core rev: 3fd8bea3e72573cca03cd3f6f4fc077cd2fd45a3) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rsync: fix CVE-2024-12084Archana Polampalli2025-01-242-0/+199
| | | | | | | | | | | | A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer. (From OE-Core rev: 17fac276e27af19b00b6263f22156a55bae6a5c9) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rsync: Delete pedantic errors re-ordering patchKhem Raj2025-01-241-44/+0
| | | | | | | | | | | | | | | It has been fixed by removing the check upstream see https://github.com/WayneD/rsync/commit/9a3449a3980421f84ac55498ba565bc112b20d6c (From OE-Core rev: c6228b8371ea5c3c452db7b536948ae96d83844b) (From OE-Core rev: 3746c60f38a6cf99f293131b8b1bfed7c73a1944) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rsync: update 3.2.5 -> 3.2.7Alexander Kanavin2025-01-242-45/+19
| | | | | | | | | | | | | | Rebase patches. (From OE-Core rev: 827c787893caa973c509acf7cac9e17fec5692a4) (From OE-Core rev: 798009f46f2044aaa0bac753430cca1964677741) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rsync: Turn on -pedantic-errors at the end of 'configure'Khem Raj2023-04-112-20/+79
| | | | | | | | | | | | | | | | | | This helps in building rsync without autoconf patch, since it will be a while that the round trip is made, better to apply this patch here until next release of autoconf. (From OE-Core rev: 11522b98697befcf13076a90cec4f8ade1fa0645) (From OE-Core rev: 3eeab90fd45a1e8de6d9d16dfdec79c72639614b) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8d6b8fb0863d81f60f8a8b53c3b5b4676d508965) Signed-off-by: pawan <badganchipv@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* rsync: Add missing prototypes to function declarationsKhem Raj2023-04-111-0/+182
| | | | | | | | | | | | | | (From OE-Core rev: c53d465865d4a9c109322074c2653a3a8b665238) (From OE-Core rev: 4ddd3559a3b6fbca3d4959be8762f44e4e948f7c) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 51d8e0e20e2965517a64e954d51a23be52e5f4f3) Signed-off-by: pawan <badganchipv@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* rsync: update 3.2.3 -> 3.2.4Florin Diaconescu2022-10-112-37/+6
| | | | | | | | | | | | | | Drop configure options that have been removed upstream. License-Update: formatting Changelog: https://download.samba.org/pub/rsync/NEWS#3.2.4 (From OE-Core rev: 4a4097ed1db8ecedbcf12388207c546d4d106e17) Signed-off-by: Florin Diaconescu <florin.diaconescu009@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* rsync: fix CVE-2020-14387Chen Qi2021-04-261-0/+31
| | | | | | | | | Backport patch to fix CVE-2020-14387. (From OE-Core rev: 13f331436747ebb8e9211feee3aa774f1acd0fee) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* rsync: Update patch statusRichard Purdie2021-02-261-1/+7
| | | | | | | | | Mark the path as submitted and effectively a backport as a different fix was added upstream addressing the issue. (From OE-Core rev: 6e82c6e1543f1e863b22d94652c90ee46b40f68a) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* rsync: Fix a file sorting determinism issueRichard Purdie2021-02-231-0/+28
| | | | | | (From OE-Core rev: f6b7f395ae2d98363e365d31f5e95ce41a12e5b4) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* rsync: update 3.2.1 -> 3.2.2Alexander Kanavin2020-08-021-5/+9
| | | | | | | (From OE-Core rev: a1b6e078e12fb3cd5057076d6ecd60152fd35074) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* rsync: update 3.1.3 -> 3.2.1Alexander Kanavin2020-06-285-398/+16
| | | | | | | | | Drop all CVE patches, add the new configure options. (From OE-Core rev: d0249eeeeeb951bfcf7606563c0cde02d49f200d) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* rsync: fix CVEs for included zlibAnuj Mittal2019-07-194-0/+389
| | | | | | | | | | | | | | | | rsync includes its own copy of zlib and doesn't recommend linking with the system version [1]. Import CVE fixes that impact zlib version 1.2.8 [2] that is currently used by rsync. [1] https://git.samba.org/rsync.git/?p=rsync.git;a=blob;f=zlib/README.rsync [2] https://nvd.nist.gov/vuln/search/results?form_type=Advanced&cves=on&cpe_version=cpe%3a%2fa%3agnu%3azlib%3a1.2.8 (From OE-Core rev: a55fbb4cb489853dfb0b4553f6e187c3f3633f48) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* rsync: remove upstream's rebuild logicRoss Burton2016-04-131-0/+69
| | | | | | | | | | | | | | | | | Upstream some well intended but broken logic to reimplement the rebuild functionality of automake. However this isn't out-of-tree safe and quite basic, which means if it ever does execute (say, configure.ac or aclocal.m4 is touched) then the build fails. As we delete ${B} and re-run autoreconf on every build this is redundant, so just delete it all. [ YOCTO #9445 ] (From OE-Core rev: ccc61cee8f097862640722abb9a9f53781efdac3) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* rsync: don't install acinclude.m4Ross Burton2016-04-131-95/+0
| | | | | | | | | | | This acinclude.m4 was actually a stale copy of upstream's generated aclocal.m4. This generates correctly now, so there isn't a need to install this by hand anymore. (From OE-Core rev: 2d1948eb325bb769af97634f99efeffe3d43cfc9) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Major layout change to the packages directoryRichard Purdie2010-08-272-0/+110
Having one monolithic packages directory makes it hard to find things and is generally overwhelming. This commit splits it into several logical sections roughly based on function, recipes.txt gives more information about the classifications used. The opportunity is also used to switch from "packages" to "recipes" as used in OpenEmbedded as the term "packages" can be confusing to people and has many different meanings. Not all recipes have been classified yet, this is just a first pass at separating things out. Some packages are moved to meta-extras as they're no longer actively used or maintained. Signed-off-by: Richard Purdie <rpurdie@linux.intel.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-07 01:13:20 +0000