rsync SSL modes: server TLS certificates are not validated, so an on-path attacker can read the transfer

Impact

rsync 3.2.0 through 3.2.3 in openssl mode, and the rsync-ssl wrapper through 3.4.4 in stunnel mode, do not validate the server certificate against a trusted CA and do not check hostname matching. An attacker positioned on the network path can present a self-signed certificate, terminate the session, and read or modify everything in transit without the client noticing. For a GPU operator the exposed asset is bulk data movement: dataset and checkpoint staging between sites, model artifacts pulled into a cluster, and backup streams. Silent modification is the sharper end of this, because a tampered training dataset or checkpoint is not something a checksum-free rsync run will surface. Only the TLS transports are affected; rsync over SSH, the far more common deployment, is not in scope of this record.

Who can reach it

An on-path network attacker between the rsync client and the rsync daemon, for sessions that use openssl mode or the rsync-ssl stunnel wrapper. No credentials are required; the CVSS 4.0 vector notes passive user involvement, consistent with the victim initiating the transfer.

What to do

Upgrade rsync to 3.5.0, which is the release the project ties the fix to. This is a package update to a command-line tool, so there is no daemon to restart on the client side and no node downtime; the next transfer uses the fixed binary. Where a rebuild is not immediate, move the affected transfers to rsync over SSH, which does not use this code path.

References

Related entries

• OpenZFS (sharenfs export generation): When an NFS share is exported to IPv6 addresses via sharenfs, OpenZFS silentlyCVE-2013-20001 · OpenZFS (sharenfs export generation)High
• Ceph CephX authentication protocol: An attacker who sniffs the storage network can replay a CephX authenticationCVE-2018-1128 · Ceph CephX authentication protocolHigh
• Emerson/Vertiv Liebert IntelliSlot Web Card (config/configUser.htm, config/configTelnet.htm): The IntelliSlot cardCVE-2018-12922 · Emerson/Vertiv Liebert IntelliSlot Web Card (config/configUser.htm, config/configTelnet.htm)High
• ntpd (protocol engine, zero-origin timestamp): Continually sending packets with a zero-origin timestamp lets a remoteCVE-2018-7185 · ntpd (protocol engine, zero-origin timestamp)High
• Ceph RADOS Gateway (RGW, Beast frontend): An unauthenticated client can crash radosgw by sending valid headers followedCVE-2019-10222 · Ceph RADOS Gateway (RGW, Beast frontend)High
• Slurm (srun --uid): Srun --uid drops privileges in the wrong order, so a step launched through it can end up runningCVE-2019-19728 · Slurm (srun --uid)High