509318396
­­­­­­­­­­­­­­­­­­
<!DOCTYPE html>
<html>
NEWS for rsync 3.1.3 SECURITY UPDATE (UNRELEASED)
Protocol: 31 (unchanged)

  This is a security-only update to the 3.1.3 release.  It backports the
  path-handling and daemon-protocol security fixes from the 3.5.0 audit onto
  the 3.1.3 base, with no feature changes.

  SECURITY FIXES:
    - Operator-supplied paths (--backup-dir, --temp-dir, --partial-dir,
      --link-dest/--compare-dest/--copy-dest, --log-file, --password-file,
      --files-from/--include-from/--exclude-from, --filter merge files,
      --write-batch/--read-batch, the daemon's motd/lock/--config, and the
      destination chdir) are now resolved with an ownership walk that follows
      a symlink component only when it is owned by uid 0 or the effective uid,
      refusing one planted by any other user.  This closes a family of
      symlink-redirection / TOCTOU file-read, file-write and
      privilege-escalation issues (CWE-59/61).  The new --insecure-links
      option (local only; never honoured by a daemon) and the per-module
      "insecure links" rsyncd.conf parameter restore the legacy
      follow-any-symlink behaviour where explicitly wanted.
    - The daemon sender's directory enumeration and file-content opens, the
      receiver temp/partial-dir creation, and the alt-dest basis lookup are
      likewise confined.
    - batch: the --write-batch replay script now single-quotes every argument
      and refuses a newline in a filter rule, preventing shell injection into
      the generated replay script.
    - socket: the daemon rejects control bytes in the host before a proxy
      CONNECT.
    - syscall: the no-AT_SYMLINK_NOFOLLOW chmod fallback fails closed.
    - receiver: token writes are capped at the advertised file length.
    - rsyncd.conf: the new "auth digest" parameter lets a daemon refuse the
      weaker MD4 challenge digest that an old (or downgraded) client selects.
    - The stunnel-based rsync-ssl helper now requires a CA certificate by
      default and binds the server certificate to the requested hostname
      (RSYNC_SSL_ALLOW_INSECURE_STUNNEL / RSYNC_SSL_SKIP_HOSTNAME_CHECK opt
      back out).

NEWS for rsync 3.1.3 (28 Jan 2018)
Protocol: 31 (unchanged)
Changes since 3.1.2:

  SECURITY FIXES:
    - Fixed a buffer overrun in the protocol's handling of xattr names and
      ensure that the received name is null terminated.
    - Fix an issue with --protect-args where the user could specify the arg in
      the protected-arg list and short-circuit some of the arg-sanitizing code.

  BUG FIXES:

    - Don't output about a new backup dir without appropriate info verbosity.
    - Fixed some issues with the sort functions in support/rsyncstats script.
    - Added a way to specify daemon config lists (e.g. users, groups, etc) that
      contain spaces (see "auth users" in the latest rsyncd.conf manpage).
    - If a backup fails (e.g. full disk) rsync exits with an error.
    - Fixed a problem with a doubled --fuzzy option combined with --link-dest.
    - Avoid invalid output in the summary if either the start or end time had
      an error.
    - We don't allow a popt alias to affect the --daemon or --server options.
    - Fix daemon exclude code to disallow attribute changes in addition to
      disallowing transfers.
    - Don't force nanoseconds to match if a non-transferred, non-checksummed
      file only passed the quick-check w/o comparing nanosecods.

  ENHANCEMENTS:

    - Added the ability for rsync to compare nanosecond times in its file-check
      comparisons, and added support nanosecond times on Mac OS X.
    - Added a short-option (-@) for --modify-window.
    - Added the --checksum-choice=NAME[,NAME] option to choose the checksum
      algorithms.
    - Added hashing of xattr names (with using -X) to improve the handling of
      files with large numbers of xattrs.
    - Added a way to filter xattr names using include/exclude/filter rules (see
      the --xattrs option in the manpage for details).
    - Added "daemon chroot|uid|gid" to the daemon config (in addition to the
      old chroot|uid|gid settings that affect the daemon's transfer process).
    - Added "syslog tag" to the daemon configuration.
    - Some manpage improvements.

  DEVELOPER RELATED:

    - Tweak the "make" output when yodl isn't around to create the man pages.
    - Changed an obsolete autoconf compile macro.
    - Support newer yodl versions when converting man pages.