4 ms·
Maybe my sleuthing skills are lacking this morning, but is there a reported minimum affected version?
by ollien 4y ago
Maybe my sleuthing skills are lacking this morning, but is there a reported minimum affected version?
- ksbrooksjr 4y agoIt looks like versions prior to 3.2.5 are affected [1]. If you're using the version of rsync bundled with MacOS, then it's affected. If you're not connecting to random malicious servers then this might not be a part of your threat model though. As long as your private keys are secure, and you've verified the public keys in your known_hosts file, then this exploit would be hard to take advantage of by a man in the middle attack. Basically, all of the normal security rules of the underlying SSH protocol apply here. [1] https://nvd.nist.gov/vuln/detail/CVE-2022-29154 https://nvd.nist.gov/vuln/detail/CVE-2022-29154