Subject: Arch-announce Digest, Vol 18, Issue 1

From: [email-masked]
Date: Fri, 17 Jan 2025 08:00:53 +0000

Send Arch-announce mailing list submissions to
	[email-masked]

To subscribe or unsubscribe via email, send a message with subject or
body 'help' to
	[email-masked]

You can reach the person managing the list at
	[email-masked]

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Arch-announce digest..."

Today's Topics:

   1. [arch-announce] Critical rsync security release 3.4.0
      (Arch Linux: Recent news updates: Robin Candau)

----------------------------------------------------------------------

Message: 1
Date: Thu, 16 Jan 2025 15:33:43 -0000
From: "Arch Linux: Recent news updates: Robin Candau"
	<[email-masked]>
Subject: [arch-announce] Critical rsync security release 3.4.0
To: [email-masked]
Message-ID: <173704162393.1323.15100814502347032609@archlinux>
Content-Type: text/plain; charset="utf-8"

We&#x27;d like to raise awareness about the rsync security release version `3.4.0-1` as described in our advisory [ASA-202501-1](https://security.archlinux.org/ASA-202501-1).

An attacker only requires anonymous read access to a vulnerable rsync server, such as a public mirror, to execute arbitrary code on the machine the server is running on. 
Additionally, attackers can take control of an affected server and read/write arbitrary files of any connected client.
Sensitive data can be extracted, such as OpenPGP and SSH keys, and malicious code can be executed by overwriting files such as `~/.bashrc` or `~/.popt`.

We highly advise anyone who runs an rsync daemon or client prior to version `3.4.0-1` to upgrade and reboot their systems immediately.
As Arch Linux mirrors are mostly synchronized using rsync, we highly advise any mirror administrator to act immediately, even though the hosted package files themselves are cryptographically signed.

All infrastructure servers and mirrors maintained by Arch Linux have already been updated.

URL: https://archlinux.org/news/critical-rsync-security-release-340/

------------------------------

Subject: Digest Footer

_______________________________________________
Arch-announce mailing list -- [email-masked]
To unsubscribe send an email to [email-masked]

------------------------------

End of Arch-announce Digest, Vol 18, Issue 1
********************************************