{"schema":"vulnpedia.research/1","cve":"CVE-2024-12084","references":[{"url":"https://access.redhat.com/errata/RHBA-2025:6470","tags":["vendor-advisory","x_refsource_REDHAT","vendor-remediation"],"source":"mitre","sourceId":"redhat","modified":"2026-10-21T16:06:50.394Z","origins":[{"source":"mitre","sourceId":"redhat","modified":"2026-10-21T16:06:50.394Z","url":"https://access.redhat.com/errata/RHBA-2025:6470"},{"source":"nvd","sourceId":"CVE-2024-12084","modified":"2026-10-21T17:17:23.127","url":"https://access.redhat.com/errata/RHBA-2025:6470"},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://access.redhat.com/errata/RHBA-2025:6470"}]},{"url":"https://access.redhat.com/security/cve/CVE-2024-12084","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","vendor-reference"],"source":"mitre","sourceId":"redhat","modified":"2026-10-21T16:06:50.394Z","origins":[{"source":"mitre","sourceId":"redhat","modified":"2026-10-21T16:06:50.394Z","url":"https://access.redhat.com/security/cve/CVE-2024-12084"},{"source":"nvd","sourceId":"CVE-2024-12084","modified":"2026-10-21T17:17:23.127","url":"https://access.redhat.com/security/cve/CVE-2024-12084"},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://access.redhat.com/security/cve/CVE-2024-12084"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2330527","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Third Party Advisory","vendor-reference"],"source":"mitre","sourceId":"redhat","modified":"2026-10-21T16:06:50.394Z","origins":[{"source":"mitre","sourceId":"redhat","modified":"2026-10-21T16:06:50.394Z","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2330527"},{"source":"nvd","sourceId":"CVE-2024-12084","modified":"2026-10-21T17:17:23.127","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2330527"},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2330527"}]},{"url":"https://kb.cert.org/vuls/id/952657","tags":["Third Party Advisory","vendor-reference"],"source":"mitre","sourceId":"redhat","modified":"2026-10-21T16:06:50.394Z","origins":[{"source":"mitre","sourceId":"redhat","modified":"2026-10-21T16:06:50.394Z","url":"https://kb.cert.org/vuls/id/952657"},{"source":"nvd","sourceId":"CVE-2024-12084","modified":"2026-10-21T17:17:23.127","url":"https://kb.cert.org/vuls/id/952657"},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://kb.cert.org/vuls/id/952657"}]},{"url":"https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj","tags":["exploit","Exploit","Vendor Advisory"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-02-26T19:09:06.939Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-02-26T19:09:06.939Z","url":"https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj"},{"source":"nvd","sourceId":"CVE-2024-12084","modified":"2026-10-21T17:17:23.127","url":"https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj"}]},{"url":"http://www.openwall.com/lists/oss-security/2025/01/14/6","tags":["Mailing List","Third Party Advisory"],"source":"mitre","sourceId":"CVE","modified":"2025-11-03T21:52:08.021Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2025-11-03T21:52:08.021Z","url":"http://www.openwall.com/lists/oss-security/2025/01/14/6"},{"source":"nvd","sourceId":"CVE-2024-12084","modified":"2026-10-21T17:17:23.127","url":"http://www.openwall.com/lists/oss-security/2025/01/14/6"}]},{"url":"https://security.netapp.com/advisory/ntap-20250131-0002/","tags":[],"source":"mitre","sourceId":"CVE","modified":"2025-11-03T21:52:08.021Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2025-11-03T21:52:08.021Z","url":"https://security.netapp.com/advisory/ntap-20250131-0002/"},{"source":"nvd","sourceId":"CVE-2024-12084","modified":"2026-10-21T17:17:23.127","url":"https://security.netapp.com/advisory/ntap-20250131-0002/"}]},{"url":"https://www.kb.cert.org/vuls/id/952657","tags":[],"source":"mitre","sourceId":"CVE","modified":"2025-11-03T21:52:08.021Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2025-11-03T21:52:08.021Z","url":"https://www.kb.cert.org/vuls/id/952657"},{"source":"nvd","sourceId":"CVE-2024-12084","modified":"2026-10-21T17:17:23.127","url":"https://www.kb.cert.org/vuls/id/952657"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-12084","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2024-12084"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12084","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12084"}]},{"source":"euvd","sourceId":"EUVD-2024-50580","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-50580","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2024-50580","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-50580"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/themirze/cve-2024-12084","source":"poc-in-github","sourceId":"CVE-2024-12084","modified":"2025-06-18T11:12:57Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2024-12084","url":"https://github.com/themirze/cve-2024-12084"},{"source":"poc-in-github","sourceId":"CVE-2024-12084","modified":"2025-06-18T11:12:57Z","url":"https://github.com/themirze/cve-2024-12084"}],"tags":[]},{"url":"https://github.com/rxerium/CVE-2024-12084","source":"poc-in-github","sourceId":"CVE-2024-12084","description":"A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.","modified":"2026-05-20T03:40:24Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2024-12084","url":"https://github.com/rxerium/CVE-2024-12084"},{"source":"poc-in-github","sourceId":"CVE-2024-12084","modified":"2026-05-20T03:40:24Z","url":"https://github.com/rxerium/CVE-2024-12084"}],"tags":[]},{"url":"https://github.com/InkeyP/CVE-2024-12084","source":"poc-in-github","sourceId":"CVE-2024-12084","description":"A easy poc for CVE-2024-12084.","modified":"2025-12-03T09:46:14Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2024-12084","url":"https://github.com/InkeyP/CVE-2024-12084"},{"source":"poc-in-github","sourceId":"CVE-2024-12084","modified":"2025-12-03T09:46:14Z","url":"https://github.com/InkeyP/CVE-2024-12084"}],"tags":[]}],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"AppStream-10.0.GA:rsync-daemon-0:3.4.1-2.el10.noarch","product":"rsync-daemon-0:3.4.1-2.el10.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHBA-2025:6470"},{"category":"workaround","details":"Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances.\n\nAdditionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). \n\nSystems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible."}],"purl":"pkg:rpm/redhat/rsync-daemon@3.4.1-2.el10?arch=noarch","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"AppStream-10.0.GA:rsync-rrsync-0:3.4.1-2.el10.noarch","product":"rsync-rrsync-0:3.4.1-2.el10.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHBA-2025:6470"},{"category":"workaround","details":"Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances.\n\nAdditionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). \n\nSystems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible."}],"purl":"pkg:rpm/redhat/rsync-rrsync@3.4.1-2.el10?arch=noarch","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.aarch64","product":"rsync-0:3.4.1-2.el10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHBA-2025:6470"},{"category":"workaround","details":"Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances.\n\nAdditionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). \n\nSystems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible."}],"purl":"pkg:rpm/redhat/rsync@3.4.1-2.el10?arch=aarch64","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.ppc64le","product":"rsync-0:3.4.1-2.el10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHBA-2025:6470"},{"category":"workaround","details":"Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances.\n\nAdditionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). \n\nSystems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible."}],"purl":"pkg:rpm/redhat/rsync@3.4.1-2.el10?arch=ppc64le","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.s390x","product":"rsync-0:3.4.1-2.el10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHBA-2025:6470"},{"category":"workaround","details":"Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances.\n\nAdditionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). \n\nSystems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible."}],"purl":"pkg:rpm/redhat/rsync@3.4.1-2.el10?arch=s390x","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.src","product":"rsync-0:3.4.1-2.el10.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHBA-2025:6470"},{"category":"workaround","details":"Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances.\n\nAdditionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). \n\nSystems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible."}],"purl":"pkg:rpm/redhat/rsync@3.4.1-2.el10?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"BaseOS-10.0.GA:rsync-0:3.4.1-2.el10.x86_64","product":"rsync-0:3.4.1-2.el10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHBA-2025:6470"},{"category":"workaround","details":"Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances.\n\nAdditionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). \n\nSystems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible."}],"purl":"pkg:rpm/redhat/rsync@3.4.1-2.el10?arch=x86_64","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"BaseOS-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.aarch64","product":"rsync-debuginfo-0:3.4.1-2.el10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHBA-2025:6470"},{"category":"workaround","details":"Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances.\n\nAdditionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). \n\nSystems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible."}],"purl":"pkg:rpm/redhat/rsync-debuginfo@3.4.1-2.el10?arch=aarch64","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"BaseOS-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.ppc64le","product":"rsync-debuginfo-0:3.4.1-2.el10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHBA-2025:6470"},{"category":"workaround","details":"Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances.\n\nAdditionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). \n\nSystems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible."}],"purl":"pkg:rpm/redhat/rsync-debuginfo@3.4.1-2.el10?arch=ppc64le","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"BaseOS-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.s390x","product":"rsync-debuginfo-0:3.4.1-2.el10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHBA-2025:6470"},{"category":"workaround","details":"Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances.\n\nAdditionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). \n\nSystems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible."}],"purl":"pkg:rpm/redhat/rsync-debuginfo@3.4.1-2.el10?arch=s390x","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"BaseOS-10.0.GA:rsync-debuginfo-0:3.4.1-2.el10.x86_64","product":"rsync-debuginfo-0:3.4.1-2.el10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHBA-2025:6470"},{"category":"workaround","details":"Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances.\n\nAdditionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). \n\nSystems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible."}],"purl":"pkg:rpm/redhat/rsync-debuginfo@3.4.1-2.el10?arch=x86_64","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"BaseOS-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.aarch64","product":"rsync-debugsource-0:3.4.1-2.el10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHBA-2025:6470"},{"category":"workaround","details":"Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances.\n\nAdditionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). \n\nSystems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible."}],"purl":"pkg:rpm/redhat/rsync-debugsource@3.4.1-2.el10?arch=aarch64","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"BaseOS-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.ppc64le","product":"rsync-debugsource-0:3.4.1-2.el10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHBA-2025:6470"},{"category":"workaround","details":"Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances.\n\nAdditionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). \n\nSystems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible."}],"purl":"pkg:rpm/redhat/rsync-debugsource@3.4.1-2.el10?arch=ppc64le","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"BaseOS-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.s390x","product":"rsync-debugsource-0:3.4.1-2.el10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHBA-2025:6470"},{"category":"workaround","details":"Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances.\n\nAdditionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). \n\nSystems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible."}],"purl":"pkg:rpm/redhat/rsync-debugsource@3.4.1-2.el10?arch=s390x","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"BaseOS-10.0.GA:rsync-debugsource-0:3.4.1-2.el10.x86_64","product":"rsync-debugsource-0:3.4.1-2.el10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHBA-2025:6470"},{"category":"workaround","details":"Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances.\n\nAdditionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). \n\nSystems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible."}],"purl":"pkg:rpm/redhat/rsync-debugsource@3.4.1-2.el10?arch=x86_64","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"red_hat_enterprise_linux_6:rsync","product":"rsync as a component of Red Hat Enterprise Linux 6","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/rsync","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"red_hat_enterprise_linux_6:rsync.src","product":"rsync.src as a component of Red Hat Enterprise Linux 6","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/rsync?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"red_hat_enterprise_linux_7:rsync","product":"rsync as a component of Red Hat Enterprise Linux 7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/rsync","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"red_hat_enterprise_linux_7:rsync.src","product":"rsync.src as a component of Red Hat Enterprise Linux 7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/rsync?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"red_hat_enterprise_linux_8:rsync","product":"rsync as a component of Red Hat Enterprise Linux 8","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/rsync","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"red_hat_enterprise_linux_8:rsync-daemon","product":"rsync-daemon as a component of Red Hat Enterprise Linux 8","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/rsync-daemon","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"red_hat_enterprise_linux_8:rsync.src","product":"rsync.src as a component of Red Hat Enterprise Linux 8","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/rsync?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"red_hat_enterprise_linux_9:rsync","product":"rsync as a component of Red Hat Enterprise Linux 9","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/rsync","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"red_hat_enterprise_linux_9:rsync-daemon","product":"rsync-daemon as a component of Red Hat Enterprise Linux 9","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/rsync-daemon","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"red_hat_enterprise_linux_9:rsync-rrsync","product":"rsync-rrsync as a component of Red Hat Enterprise Linux 9","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/rsync-rrsync","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"red_hat_enterprise_linux_9:rsync.src","product":"rsync.src as a component of Red Hat Enterprise Linux 9","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/rsync?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"red_hat_openshift_container_platform_4:openshift/ose-rhel-coreos-8","product":"openshift/ose-rhel-coreos-8 as a component of Red Hat OpenShift Container Platform 4","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/ose-rhel-coreos-8?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-8","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]},{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json","productId":"red_hat_openshift_container_platform_4:openshift/ose-rhel-coreos-9","product":"openshift/ose-rhel-coreos-9 as a component of Red Hat OpenShift Container Platform 4","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/ose-rhel-coreos-9?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-9","origins":[{"source":"redhat","sourceId":"CVE-2024-12084","modified":"2026-10-21T16:06:46+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json"}]}],"vendorCoverage":{"total":28,"shown":28,"omitted":0,"source":"redhat"}}