rsync 3.5.0 has been released, addressing 33 security issues uncovered through a focused audit of path handling and the daemon protocol, a fuzzing pass on the daemon protocol, and reports from external researchers, along with several robustness hardenings. CVE IDs were assigned by VulnCheck as CNA, with precise version ranges noted for each advisory since many affect only narrower ranges than all versions prior to 3.5.0. Every fix includes a regression test that fails on the unfixed codebase.
Questions this post answers
What security issues does rsync 3.5.0 fix?
rsync 3.5.0 fixes 33 security issues discovered through a focused audit of rsync's path handling and daemon protocol, a companion daemon-protocol fuzzing pass, and reports from external researchers, plus several robustness hardenings. CVE IDs were assigned by VulnCheck as the CNA, and each advisory specifies a precise 'introduced in' version range, many narrower than all versions before 3.5.0. Teams patching rsync deployments can track CVE fixes like these on daily.dev.
Are the CVE fixes in rsync 3.5.0 tested?
Yes, every security fix in rsync 3.5.0 ships with a regression test in the test suite that fails on the unfixed tree, confirming each vulnerability is actually addressed and guarding against regressions in future releases. Developers verifying patch quality before upgrading rsync can follow release details on daily.dev.