Rsync 3.4 has been released with fixes for several critical security vulnerabilities

Version 3.4 of rsync, an open source utility for fast incremental file transfer, has been released to address multiple significant security vulnerabilities. Rsync, commonly used for backing up Linux systems, has been updated not for new features but to fix these critical security issues.

The Google Cloud Vulnerability Research team, along with Aleksei Gorban, identified six vulnerabilities, including a heap buffer overflow, information leak, and server issues that could expose arbitrary client files or allow clients to write files outside the destination directory via symbolic links. Additional vulnerabilities include a safe-links bypass and a symlink race condition.

Beyond these security fixes, version 3.4 includes a few bug fixes and introduces continuous integration builds for FreeBSD and Solaris. The rsync protocol number has also been updated to 32, facilitating server updates in response to these security issues.