CVE-2014-8990: lsyncd project lsyncd – CVSS 7.5 · Watchpost

← All vulnerabilities

CVE-2014-8990

HIGH 7.5CVE-2014-8990 · Published 05/12/2014 · updated 17/06/2026

In short

CVE-2014-8990 is a HIGH (CVSS 7.5) vulnerability affecting lsyncd (lsyncd project).
Chance of exploitation in the next 30 days (EPSS): 5.2%, higher than 92.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
lsyncd lsyncd_project	`≤ 2.1.5`	No fix yet

Description

default-rsyncssh.lua in Lsyncd 2.1.5 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.

References

lists.fedoraproject.org/pipermail/package-announce/2014-December/145114.html · Third Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2014-December/145131.html · Third Party Advisory
secunia.com/advisories/62321
debian.org/security/2015/dsa-3130 · Third Party Advisory
openwall.com/lists/oss-security/2014/11/19/1 · Mailing List
openwall.com/lists/oss-security/2014/11/20/5 · Exploit
securityfocus.com/bid/71179 · Third Party Advisory
axkibe/lsyncd commit 18f02ad · Exploit
axkibe/lsyncd commit e6016b3 · Exploit
axkibe/lsyncd · Issue Tracking
security.gentoo.org/glsa/201702-05

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free