Detections
Analytics

Alpine: multiple rrsync packages: security update to 3.4.3-r0

high Tenable Self-Hosted Container Security Plugin ID 442236

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in
 recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process.
 Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a
 specially crafted file list where the first sorted entry is not the leading dot directory, followed by a
 transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes
 before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in
 a deterministic SIGSEGV crash of the rsync client. (CVE-2026-43620)

 - Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file
 handling that allows attackers to redirect file writes outside intended directories by replacing parent
 directory components with symbolic links. Attackers with write access to a module path can exploit this
 race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and
 achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only
 be triggered if the chroot setting is false. (CVE-2026-29518)

 - Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's
 hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-
 based deny rules by controlling the PTR record for their source IP address, allowing connections from
 hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.
 (CVE-2026-43617)

 - Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder
 where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an
 overflow that causes the receiver process to read and return data from outside the intended buffer bounds.
 Attackers can exploit this vulnerability to disclose process memory contents including environment
 variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR
 effectiveness and facilitating further exploitation. (CVE-2026-43618)

 - Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls
 including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow
 local attackers to redirect operations to files outside the exported rsync module. Attackers with local
 filesystem access can exploit the timing window between path resolution and syscall execution by swapping
 symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files
 outside the intended module boundary on rsync daemons configured with 'use chroot = no'. (CVE-2026-43619)

Solution

Update the rrsync library and its related packages to version 3.4.3-r0 or later.

See Also

https://security.alpinelinux.org/vuln/CVE-2026-29518

https://security.alpinelinux.org/vuln/CVE-2026-43617

https://security.alpinelinux.org/vuln/CVE-2026-43618

https://security.alpinelinux.org/vuln/CVE-2026-43619

https://security.alpinelinux.org/vuln/CVE-2026-43620

https://security.alpinelinux.org/vuln/CVE-2026-45232

Plugin Details

Severity: High

ID: 442236

Version: Revision 1.7

Type: Local

Published: 5/20/2026

Updated: 8/21/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.26

CVSS v2

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-43620

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.3

Threat Score: 4.4

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-29518

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 5/20/2026

Reference Information

CVE: CVE-2026-29518, CVE-2026-43617, CVE-2026-43618, CVE-2026-43619, CVE-2026-43620, CVE-2026-45232