CVE-2020-14387

    Dashboard / Vulnerabilities / CVE-2020-14387

    CVE-2020-14387

    Published: 27 May 2021Last Modified: 27 Aug 2026

    Summary:

    Details: A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.

    References: https://bugzilla.redhat.com/show_bug.cgi?id=1875549

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- a8fc8fc2d22ba7243b96decb91c586682a05e4a1
    Fixed -0ac7ebceef70417355f25daf9e2fd94e84c49749

    Affected versions

    3.2.0-NA
    3.2.0-pre1
    3.2.0-pre2
    3.2.0-pre3

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2020-14387 | CVE-DB