| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: rsync | Distribution: openSUSE Tumbleweed |
| Version: 3.4.3 | Vendor: openSUSE |
| Release: 2.3 | Build date: Tue Jun 9 23:24:43 2026 |
| Group: Productivity/Networking/Other | Build host: reproducible |
| Size: 1026311 | Source RPM: rsync-3.4.3-2.3.src.rpm |
| Packager: http://bugs.opensuse.org | |
| Url: https://rsync.samba.org/ | |
| Summary: Versatile tool for fast incremental file transfer | |
Rsync is a fast and extraordinarily versatile file copying tool. It can copy locally, to/from another host over any remote shell, or to/from a remote rsync daemon. It offers a large number of options that control every aspect of its behavior and permit very flexible specification of the set of files to be copied. It is famous for its delta-transfer algorithm, which reduces the amount of data sent over the network by sending only the differences between the source files and the existing files in the destination. Rsync is widely used for backups and mirroring and as an improved copy command for everyday use.
GPL-3.0-or-later
* Tue Jun 09 2026 Matej Cepl <mcepl@cepl.eu>
- Add missing python3-base BR
* Thu May 21 2026 David Anes <david.anes@suse.com>
- Fixed some warnings while building the rpm.
- Added patches:
- rsync-python-3.6-tests.patch:
Small patch to support running tests on python 3.6+:
- rsync-openat2-glibc-missing.patch:
Small patch to build on kernels >= 5.6+ where openat2
is not defined in glibc.
- Removed patches already upstream:
- rsync-no-libattr.patch
- rsync-CVE-2025-10158.patch
- rsync-CVE-2026-41035.patch
- rsync341-gcc15-bool.patch
- Removed support for the unmaintained rsync-patches archive,
which in turn removes support for SLP. These patches are not
being shipped anymore.
- Update to 3.4.3:
- SECURITY FIXES:
Six CVEs are fixed in this release. Three of the six
(CVE-2026-29518, CVE-2026-43617, CVE-2026-43619) require
non-default daemon configuration to reach: the first and
third need use chroot = no for a module, the second needs
daemon chroot = ... set in rsyncd.conf.
Two (CVE-2026-43618, CVE-2026-43620) are reachable from a
normal pull or a normal authenticated daemon connection.
The sixth (CVE-2026-45232) is reachable only when RSYNC_PROXY
is set and the proxy (or a MITM) returns a pathological
response.
Complete list of changes: https://download.samba.org/pub/rsync/NEWS#3.4.3
- CVE-2026-29518, bsc#1264511: Symlink-Race TOCTOU in Daemon (use chroot = no)
TOCTOU symlink race condition allowing local privilege
escalation in daemon mode without chroot. An rsync daemon
configured with "use chroot = no" was exposed to a
time-of-check / time-of-use race on parent path components.
- CVE-2026-43617, bsc#1264515: Authorization Bypass via Hostname Resolution
Hostname/ACL bypass on an rsync daemon configured with
daemon chroot = /X in rsyncd.conf when the chroot tree
lacks DNS resolution support. The reverse-DNS lookup of
the connecting client was performed after the daemon chroot
had been entered; if /X did not contain the libc resolver
fixtures (/etc/resolv.conf, /etc/nsswitch.conf, /etc/hosts,
NSS service modules) the lookup failed and the connecting
hostname was set to "UNKNOWN", causing hostname-based deny
rules to silently fail open. IP-based ACLs are unaffected.
The per-module use chroot setting is unrelated to this
issue. The fix performs the lookup before entering the
daemon chroot.
- CVE-2026-43618, bsc#1264512: Integer Overflow Information Disclosure
Integer overflow in the compressed-token decoder enabling
remote memory disclosure to an authenticated daemon peer.
Workaround for older releases: refuse options = compress in rsyncd.conf.
- CVE-2026-43619, bsc#1264514: Symlink Race Condition via Path-Based Syscalls
Symlink races on path-based system calls in "use chroot=no"
daemon mode (generalisation of CVE-2026-29518). Earlier
fixes for symlink races on the receiver's open() call
missed the same race class on every other path-based system
call: chmod, lchown, utimes, rename, unlink, mkdir, symlink,
mknod, link, rmdir and lstat.
Default "use chroot = yes" is not exposed.
- CVE-2026-43620, bsc#1264513: Out-of-Bounds Array Read via recv_files()
Out-of-bounds read in the receiver's recv_files() enabling
remote denial-of-service of any client pulling from a
malicious server (incomplete fix of commit 797e17f).
Workaround for older releases: --no-inc-recursive on the client.
- CVE-2026-45232, bsc#1265296: Off-by-one stack OOB write in HTTP CONNECT proxy
response parsing
Off-by-one out-of-bounds stack write in the rsync client's
HTTP CONNECT proxy handler (establish_proxy_connection() in
socket.c). The fix detects the "buffer filled without finding
\n" case explicitly by position and refuses the response with
"proxy response line too long".
- In addition to the six CVE fixes, this release adds defence-in-depth
hardening on several adjacent paths.
- BUG FIXES:
- Fixed a regression introduced by the 3.4.0 secure_relative_open().
- Complete list of fixes in version 3.4.2:
- https://download.samba.org/pub/rsync/NEWS#3.4.2
* Thu May 07 2026 David Anes <david.anes@suse.com>
- Security update (CVE-2026-41035, bsc#1262223): rsync: count of
entries mismatch can lead to a use-after-free
- Add rsync-CVE-2026-41035.patch
* Tue Dec 16 2025 David Anes <david.anes@suse.com>
- Security update (CVE-2025-10158, bsc#1254441): rsync: Out of
bounds array access via negative index
- Add rsync-CVE-2025-10158.patch
* Fri Mar 28 2025 Friedrich Haubensak <hsk17@mail.de>
- Add rsync341-gcc15-bool.patch to fix gcc15 compile time error
* Wed Jan 22 2025 Dominique Leuenberger <dimstar@opensuse.org>
- Drop rcFOO symlinks for CODE16 (PED-266).
* Fri Jan 17 2025 ecsos <ecsos@opensuse.org>
- Update to 3.4.1
* BUG FIXES:
- fixed handling of -H flag with conflict in internal flag values
- fixed a user after free in logging of failed rename
- fixed build on systems without openat()
- removed dependency on alloca() in bundled popt
* DEVELOPER RELATED:
- fix to permissions handling in the developer release script
- Drop 705.patch, because now in upstream.
* Thu Jan 16 2025 Andreas Stieger <andreas.stieger@gmx.de>
- update to 3.4.1
* fixed handling of -H flag with conflict in internal flag values
(replaces 705.patch)
* fixed a user after free in logging of failed rename
* fixed build on systems without openat()
* removed dependency on alloca() in bundled popt
* Wed Jan 15 2025 Marcus Rueckert <mrueckert@suse.de>
- Backport patch from PR 705 to fix broken handling of hashes and
hard links:
* Add 705.patch
* Wed Jan 15 2025 Angel Yankov <angel.yankov@suse.com>
- Update to 3.4
* Bump to protocol 32
Drop CVE patches:
* Drop rsync-gcc14.patch
* Removed rsync-CVE-2024-12084-overflow-01.patch
* Removed rsync-CVE-2024-12084-overflow-02.patch
* Removed rsync-CVE-2024-12085.patch
* Removed rsync-CVE-2024-12086_01.patch
* Removed rsync-CVE-2024-12086_02.patch
* Removed rsync-CVE-2024-12086_03.patch
* Removed rsync-CVE-2024-12086_04.patch
* Removed rsync-CVE-2024-12087_01.patch
* Removed rsync-CVE-2024-12087_02.patch
* Removed rsync-CVE-2024-12088.patch
* Removed rsync-CVE-2024-12747.patch
* Tue Jan 14 2025 Angel Yankov <angel.yankov@suse.com>
- Security update,CVE-2024-12747, bsc#1235475 race condition in handling symbolic links
* Added rsync-CVE-2024-12747.patch
* Thu Jan 09 2025 Angel Yankov <angel.yankov@suse.com>
- Security update, fix multiple vulnerabilities:
* CVE-2024-12084, bsc#1234100 - Heap Buffer Overflow in Checksum Parsing
* CVE-2024-12085, bsc#1234101 - Info Leak via uninitialized Stack contents defeats ASLR
* CVE-2024-12086, bsc#1234102 - Server leaks arbitrary client files
* CVE-2024-12087, bsc#1234103 - Server can make client write files outside of destination directory using symbolic links
* CVE-2024-12088, bsc#1234104 - --safe-links Bypass
* Added rsync-CVE-2024-12084-overflow-01.patch
* Added rsync-CVE-2024-12084-overflow-02.patch
* Added rsync-CVE-2024-12085.patch
* Added rsync-CVE-2024-12086_01.patch
* Added rsync-CVE-2024-12086_02.patch
* Added rsync-CVE-2024-12086_03.patch
* Added rsync-CVE-2024-12086_04.patch
* Added rsync-CVE-2024-12087_01.patch
* Added rsync-CVE-2024-12087_02.patch
* Added rsync-CVE-2024-12088.patch
* Fri Sep 06 2024 Marcus Meissner <meissner@suse.com>
- rsync-gcc14.patch: fixed the ipv6 configure check (bsc#1230156)
* Thu Sep 05 2024 Georg Pfuetzenreuter <mail+rpm@georg-pfuetzenreuter.net>
- Add rsyncd-return-from-list-command-with-0.patch to not treat #list as failure
* Mon Aug 26 2024 Thorsten Kukuk <kukuk@suse.com>
- add patch rsync-run-dir.patch:
* Drop dependency on /var/run compat symlink, this causes problems
on image based systems
* Thu May 23 2024 David Anes <david.anes@suse.com>
- Correcly enable SIMD in x64: the flag was renamed from
- -enable-simd to -enable-roll-simd in 3.2.4
- Remove leftovers from previous versions:
* rsync-patches-3.2.7.tar.gz
* rsync-patches-3.2.7.tar.gz.asc
* Thu Apr 18 2024 David Anes <david.anes@suse.com>
- Update to 3.3.0
* BUG FIXES:
- Fixed a bug with --sparse --inplace where a trailing gap in
the source file would not clear out the trailing data in the
destination file.
- Fixed an buffer overflow in the checksum2 code if SHA1 is
being used for the checksum2 algorithm.
- Fixed an issue when rsync is compiled using _FORTIFY_SOURCE so
that the extra tests don't complain about a strlcpy() limit
value (which was too large, even though it wasn't possible for
the larger value to cause an overflow).
(fix bsc#1214616, bsc#1214249)
- Add a backtick to the list of characters that the filename
quoting needs to escape using backslashes.
- Fixed a string-comparison issue in the internal handling of
- -progress (a locale such as tr_TR.utf-8 needed the internal
triggering of --info options to use upper-case flag names to
ensure that they match).
- Make sure that a local transfer marks the sender side as
trusted.
- Change the argv handling to work with a newer popt library
- - one that likes to free more data than it used to.
- Rsync now calls OpenSSL_add_all_algorithms() when compiled
against an older openssl library.
- Fixed a problem in the daemon auth for older protocols
(29 and before) if the openssl library is being used to
compute MD4 checksums.
- Fixed rsync -VV on Cygwin -- it needed a flush of stdout.
- Fixed an old stats bug that counted devices as symlinks.
* ENHANCEMENTS:
- Enhanced rrsync with the -no-overwrite option that allows you
to ensure that existing files on your restricted but writable
directory can't be modified.
- Enhanced the manpages to mark links with .UR & .UE. If your
nroff doesn't support these idioms, touch the file
.md2man-force in the source directory so that md-convert gets
called with the --force-link-text option, and that should
ensure that your manpages are still readable even with the
ignored markup.
- Some manpage improvements on the handling of [global] modules.
- Changed the mapfrom & mapto perl scripts (in the support dir)
into a single python script named idmap. Converted a couple
more perl scripts into python.
- Changed the mnt-excl perl script (in the support dir) into a
python script.
* DEVELOPER RELATED:
- Updated config.guess (timestamp 2023-01-01) and config.sub
(timestamp 2023-01-21).
- Drop rsync-fortified-strlcpy-fix.patch (included upstream).
* Tue Mar 12 2024 Bernhard Wiedemann <bwiedemann@suse.com>
- Avoid package changes in %check
* Wed Nov 29 2023 Stefan Schubert <schubi@suse.com>
- Moved rsyncd.conf and rsyncd.secrets to /usr/etc.
* Add rsync-usr-etc.patch
* Wed Sep 06 2023 David Anes <david.anes@suse.com>
- Rename patch to follow naming patch policies:
fortified-strlcpy-fix.patch -> rsync-fortified-strlcpy-fix.patch
* Wed Sep 06 2023 Thorsten Kukuk <kukuk@suse.com>
- Use "slp" for bcond, not "openslp", like we use for all other
packages, too.
- Disable slp patch and configure option if bcond slp is disabled.
* Tue Sep 05 2023 Dirk Müller <dmueller@suse.com>
- add fortified-strlcpy-fix.patch (bsc#1214616, bsc#1214249)
* Tue Sep 05 2023 Fabian Vogt <fvogt@suse.com>
- Disable openslp support on new distros (bsc#1214884)
* Wed Jul 26 2023 Antonio Teixeira <antonio.teixeira@suse.com>
- Add support directory to %docdir.
Includes some upstream provided scripts such as rrsync. (bsc#1212198)
* Thu Apr 06 2023 Johannes Segitz <jsegitz@suse.com>
- Switch rsyncd symlink to a wrapper script to allow setting a distinct
SELinux type (bsc#1209654)
/usr/bin/rsync /usr/bin/rsync-ssl /usr/bin/rsyncstats /usr/etc/logrotate.d/rsync /usr/etc/rsyncd.conf /usr/etc/rsyncd.secrets /usr/lib/systemd/system/rsyncd.service /usr/lib/systemd/system/rsyncd.socket /usr/lib/systemd/system/rsyncd@.service /usr/sbin/rsyncd /usr/share/doc/packages/rsync /usr/share/doc/packages/rsync/NEWS.md /usr/share/doc/packages/rsync/README.md /usr/share/doc/packages/rsync/support /usr/share/doc/packages/rsync/support/Makefile /usr/share/doc/packages/rsync/support/atomic-rsync /usr/share/doc/packages/rsync/support/cvs2includes /usr/share/doc/packages/rsync/support/deny-rsync /usr/share/doc/packages/rsync/support/file-attr-restore /usr/share/doc/packages/rsync/support/files-to-excludes /usr/share/doc/packages/rsync/support/git-set-file-times /usr/share/doc/packages/rsync/support/idmap /usr/share/doc/packages/rsync/support/install_deps_ubuntu.sh /usr/share/doc/packages/rsync/support/instant-rsyncd /usr/share/doc/packages/rsync/support/json-rsync-version /usr/share/doc/packages/rsync/support/logfilter /usr/share/doc/packages/rsync/support/lsh /usr/share/doc/packages/rsync/support/lsh.sh /usr/share/doc/packages/rsync/support/mnt-excl /usr/share/doc/packages/rsync/support/munge-symlinks /usr/share/doc/packages/rsync/support/nameconvert /usr/share/doc/packages/rsync/support/rrsync /usr/share/doc/packages/rsync/support/rrsync.1.md /usr/share/doc/packages/rsync/support/rsync-no-vanished /usr/share/doc/packages/rsync/support/rsync-slash-strip /usr/share/doc/packages/rsync/support/rsyncstats /usr/share/doc/packages/rsync/support/savetransfer.c /usr/share/doc/packages/rsync/tech_report.tex /usr/share/licenses/rsync /usr/share/licenses/rsync/COPYING /usr/share/man/man1/rsync-ssl.1.gz /usr/share/man/man1/rsync.1.gz /usr/share/man/man5/rsyncd.conf.5.gz
Generated by rpm2html 1.8.1
Fabrice Bellet, Sun Aug 2 02:32:54 2026