A rsync security update has been released for Slackware 14.0, 14.1, 14.2, 15.0, and -current.
slackware-security: rsync (SSA:2022-227-01)
[slackware-security] rsync (SSA:2022-227-01)
New rsync packages are available for Slackware 14.0, 14.1, 14.2, 15.0,
and -current to fix a security issue.
Here are the details from the Slackware 15.0 ChangeLog:
+--------------------------+
patches/packages/rsync-3.2.5-i586-1_slack15.0.txz: Upgraded.
Added some file-list safety checking that helps to ensure that a rogue
sending rsync can't add unrequested top-level names and/or include recursive
names that should have been excluded by the sender. These extra safety
checks only require the receiver rsync to be updated. When dealing with an
untrusted sending host, it is safest to copy into a dedicated destination
directory for the remote content (i.e. don't copy into a destination
directory that contains files that aren't from the remote host unless you
trust the remote host).
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29154
(* Security fix *)
+--------------------------+
Where to find the new packages:
+-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab
( http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.
Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/rsync-3.2.5-i486-1_slack14.0.txz
Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/rsync-3.2.5-x86_64-1_slack14.0.txz
Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/rsync-3.2.5-i486-1_slack14.1.txz
Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/rsync-3.2.5-x86_64-1_slack14.1.txz
Updated package for Slackware 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/rsync-3.2.5-i586-1_slack14.2.txz
Updated package for Slackware x86_64 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/rsync-3.2.5-x86_64-1_slack14.2.txz
Updated package for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/rsync-3.2.5-i586-1_slack15.0.txz
Updated package for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/rsync-3.2.5-x86_64-1_slack15.0.txz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/rsync-3.2.5-i586-1.txz
Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/rsync-3.2.5-x86_64-1.txz
MD5 signatures:
+-------------+
Slackware 14.0 package:
3f0ca0f8ed464ca170fde81edaa2c805 rsync-3.2.5-i486-1_slack14.0.txz
Slackware x86_64 14.0 package:
100660633045818b403259797ebe2aa3 rsync-3.2.5-x86_64-1_slack14.0.txz
Slackware 14.1 package:
dd89e119220509baf81a56c176e497a0 rsync-3.2.5-i486-1_slack14.1.txz
Slackware x86_64 14.1 package:
698dfde7b2c3a6a9d7b2b39206c5bf24 rsync-3.2.5-x86_64-1_slack14.1.txz
Slackware 14.2 package:
d330a2802b454e88b29a3c52686cc06e rsync-3.2.5-i586-1_slack14.2.txz
Slackware x86_64 14.2 package:
366f07d475fae2645d6c446207e5327b rsync-3.2.5-x86_64-1_slack14.2.txz
Slackware 15.0 package:
81f90b336a233c240c5ed3a7e54635f9 rsync-3.2.5-i586-1_slack15.0.txz
Slackware x86_64 15.0 package:
70a01b72fc4e502650b952ab2e336e93 rsync-3.2.5-x86_64-1_slack15.0.txz
Slackware -current package:
45eb531038158b16250c63c370f8a994 n/rsync-3.2.5-i586-1.txz
Slackware x86_64 -current package:
d67bac8495b92af8160ea7c4b8ed79b3 n/rsync-3.2.5-x86_64-1.txz
Installation instructions:
+------------------------+
Upgrade the package as root:
# upgradepkg rsync-3.2.5-i586-1_slack15.0.txz
