CVE-2014-8242

MITTEL 5.8CVE-2014-8242 · Published 26/10/2015 · updated 17/06/2026

Kurz gesagt

CVE-2014-8242 ist eine Schwachstelle (MITTEL (CVSS 5.8)) in librsync (librsync project).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.9%, höher als bei 87.2% aller Schwachstellen.
Abhilfe: auf 1.0.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
librsync librsync_project	`< 1.0.0`	`1.0.0`

Description

librsync before 1.0.0 uses a truncated MD4 checksum to match blocks, which makes it easier for remote attackers to modify transmitted data via a birthday attack.

References

lists.fedoraproject.org/pipermail/package-announce/2015-March/151105.html · Mailing List
lists.fedoraproject.org/pipermail/package-announce/2015-March/152355.html · Mailing List
lists.fedoraproject.org/pipermail/package-announce/2015-March/152366.html · Mailing List
lists.opensuse.org/opensuse-updates/2015-10/msg00034.html · Mailing List
openwall.com/lists/oss-security/2014/07/28/1 · Mailing List
openwall.com/lists/oss-security/2014/08/05/5 · Mailing List
openwall.com/lists/oss-security/2014/10/13/2 · Mailing List
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
librsync/librsync · Patch
librsync/librsync release v1.0.0 · Patch
security.gentoo.org/glsa/201605-04

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free