Detections
Analytics

Echo: rsync: security update to 3.5.0+ds1-1

medium Tenable Cloud Security Plugin ID 464077

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping
 interface that allows local attackers to forge protocol messages by creating user or group names
 containing newline characters. Attackers can inject malicious newline characters into names communicated
 over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data
 as legitimate protocol input, corrupting uid/gid mapping logic. (CVE-2026-53788)

Solution

Update the rsync library and its related packages to version 3.5.0+ds1-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-53788

Plugin Details

Severity: Medium

ID: 464077

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 2.1

Percentile: 7.93

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-53788

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 2.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/13/2026

Vulnerability Publication Date: 8/13/2026

Reference Information

CVE: CVE-2026-53788