--- title: Major rsync upgrade in Debian because of 33 CVEs | daily.dev description: Debian trixie-security has shipped rsync 3.5.0 as a single package bump rather than backporting 33 individual CVE patches, after the maintainer judged the bump... canonical: https://daily.dev/posts/major-rsync-upgrade-in-debian-because-of-33-cves-gxj2xjzsc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Major rsync upgrade in Debian because of 33 CVEs | daily.dev og:description: Debian trixie-security has shipped rsync 3.5.0 as a single package bump rather than backporting 33 individual CVE patches, after the maintainer judged the bump... og:url: https://daily.dev/posts/major-rsync-upgrade-in-debian-because-of-33-cves-gxj2xjzsc og:image: https://api.daily.dev/og/posts/GXj2XJzSc.png og:image:alt: Major rsync upgrade in Debian because of 33 CVEs og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Major rsync upgrade in Debian because of 33 CVEs **[Lobsters](https://daily.dev/sources/lobsters)** · 3 min read · 1 upvotes · 0 comments ## Summary Debian trixie-security has shipped rsync 3.5.0 as a single package bump rather than backporting 33 individual CVE patches, after the maintainer judged the bump carried lower risk. The update closes symlink-following vulnerabilities on operator-supplied paths and destination arguments, tightens rrsync's sandboxing (blocking --debug, --copy-unsafe-links, device creation), fixes --chmod=a+s to set both setuid and setgid, and changes several rsyncd authentication behaviors around proxy protocol, hosts deny/allow resolution, and auth users parsing. rsync-ssl now verifies and hostname-checks the server certificate by default. Comments note rrsync in 3.5.0 was itself broken and fixed in 3.5.1, and discuss how unusual a mid-stable version bump is for Debian. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What changed in rsync 3.5.0 regarding symlinks and destination paths? Rsync 3.5.0 no longer follows operator-supplied paths through untrusted symlinks. The destination directory and arguments like --backup-dir, --temp-dir, --partial-dir, --link-dest, --log-file, and --password-file are resolved one component at a time, only following a symlink owned by root or the invoking user; otherwise it is refused with 'refusing to follow a symlink owned by an untrusted user'. --insecure-links restores old behavior but only locally, not for daemons. _Teams hardening rsync-based backup pipelines can track security-driven behavior changes like this on daily.dev._ ### Why did Debian bump rsync to a whole new version instead of backporting CVE patches individually in trixie-security? Debian's rsync maintainer decided to bump the trixie-security package to 3.5.0+ds1-0+deb13u1 to fix 33 CVEs at once, concluding that a full version bump carried lower risk than backporting all 33 patches individually after analyzing the extra non-CVE changes introduced by the bump. _Sysadmins deciding between patch backports and full version bumps can follow precedents like this on daily.dev._ ### What rsyncd configuration behaviors changed in rsync 3.5.0 that could affect who can connect? In rsync 3.5.0, 'proxy protocol = true' without 'proxy protocol hosts' now rejects every connection instead of trusting a client-supplied PROXY header; 'hosts deny' fails closed when a hostname cannot be resolved; 'auth users' entries starting with a comma now split correctly on commas; and 'hosts allow'/'hosts deny' bracket patterns now fold case, so some previously-missed rules now match. _Admins auditing rsyncd access rules after an upgrade can keep up with changes like these on daily.dev._ ## Similar posts on daily.dev - [rsync 3.4.4 released with regression fixes](https://daily.dev/posts/rsync-3-4-4-released-with-regression-fixes-5czlyoevq) · LWN.net · 0 upvotes · 0 comments - [Debian -- News -- Updated Debian 13: 13.5 released](https://daily.dev/posts/debian----news----updated-debian-13-13-5-released-zahrnzbme) · Debian · 0 upvotes · 0 comments - [Most people will miss Ubuntu 26.04's biggest security upgrade — and that's the point](https://daily.dev/posts/most-people-will-miss-ubuntu-26-04-s-biggest-security-upgrade-and-that-s-the-point-zlmzt4y61) · XDA Developers · 28 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux) [View this post on daily.dev](https://daily.dev/posts/major-rsync-upgrade-in-debian-because-of-33-cves-gxj2xjzsc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Major rsync upgrade in Debian because of 33 CVEs","url":"https://daily.dev/posts/major-rsync-upgrade-in-debian-because-of-33-cves-gxj2xjzsc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/major-rsync-upgrade-in-debian-because-of-33-cves-gxj2xjzsc"},"datePublished":"2026-10-01T16:38:25.291Z","dateModified":"2026-10-01T16:46:05.471Z","description":"Debian trixie-security has shipped rsync 3.5.0 as a single package bump rather than backporting 33 individual CVE patches, after the maintainer judged the bump...","image":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","thumbnailUrl":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","isAccessibleForFree":true,"articleSection":"Lobsters","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Lobsters","logo":"https://media.daily.dev/image/upload/s--tl8v_Fku--/f_auto,t_logo/v1698841318/logos/lobste.jpg","url":"https://daily.dev/sources/lobsters"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/major-rsync-upgrade-in-debian-because-of-33-cves-gxj2xjzsc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,linux","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Lobsters","item":"https://daily.dev/sources/lobsters"},{"@type":"ListItem","position":3,"name":"Major rsync upgrade in Debian because of 33 CVEs"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/major-rsync-upgrade-in-debian-because-of-33-cves-gxj2xjzsc#faq","mainEntity":[{"@type":"Question","name":"What changed in rsync 3.5.0 regarding symlinks and destination paths?","acceptedAnswer":{"@type":"Answer","text":"Rsync 3.5.0 no longer follows operator-supplied paths through untrusted symlinks. The destination directory and arguments like --backup-dir, --temp-dir, --partial-dir, --link-dest, --log-file, and --password-file are resolved one component at a time, only following a symlink owned by root or the invoking user; otherwise it is refused with 'refusing to follow a symlink owned by an untrusted user'. --insecure-links restores old behavior but only locally, not for daemons. Teams hardening rsync-based backup pipelines can track security-driven behavior changes like this on daily.dev."}},{"@type":"Question","name":"Why did Debian bump rsync to a whole new version instead of backporting CVE patches individually in trixie-security?","acceptedAnswer":{"@type":"Answer","text":"Debian's rsync maintainer decided to bump the trixie-security package to 3.5.0+ds1-0+deb13u1 to fix 33 CVEs at once, concluding that a full version bump carried lower risk than backporting all 33 patches individually after analyzing the extra non-CVE changes introduced by the bump. Sysadmins deciding between patch backports and full version bumps can follow precedents like this on daily.dev."}},{"@type":"Question","name":"What rsyncd configuration behaviors changed in rsync 3.5.0 that could affect who can connect?","acceptedAnswer":{"@type":"Answer","text":"In rsync 3.5.0, 'proxy protocol = true' without 'proxy protocol hosts' now rejects every connection instead of trusting a client-supplied PROXY header; 'hosts deny' fails closed when a hostname cannot be resolved; 'auth users' entries starting with a comma now split correctly on commas; and 'hosts allow'/'hosts deny' bracket patterns now fold case, so some previously-missed rules now match. Admins auditing rsyncd access rules after an upgrade can keep up with changes like these on daily.dev."}}]} ```