CVE-2018-5764

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-01-17 · updated 2026-06-17

Description

The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers to bypass an argument-sanitization protection mechanism.

Affected products

Canonical Ubuntu Linux: 14.04, 16.04, 17.10
Debian Linux: 7.0, 8.0, 9.0
RsyncProject rsync: before 3.1.3 — fixed in 3.1.3

How to fix

Upgrade to a fixed version: RsyncProject rsync 3.1.3. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/102803
http://www.securitytracker.com/id/1040276
https://download.samba.org/pub/rsync/src-previews/rsync-3.1.3pre1-NEWS
https://git.samba.org/rsync.git/?p=rsync.git%3Ba=commit%3Bh=7706303828fcde524222babb2833864a4bd09e07
https://lists.debian.org/debian-lts-announce/2018/01/msg00021.html
https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html
https://lists.debian.org/debian-lts-announce/2021/11/msg00028.html
https://security.gentoo.org/glsa/201805-04
https://usn.ubuntu.com/3543-1/
http://www.securityfocus.com/bid/102803
http://www.securitytracker.com/id/1040276
https://download.samba.org/pub/rsync/src-previews/rsync-3.1.3pre1-NEWS

Get alerted when CVE-2018-5764 or the next vulnerability affects your stack