CVE-2014-8242

MOYENNE 5.8CVE-2014-8242 · Published 26/10/2015 · updated 17/06/2026

En bref

CVE-2014-8242 est une vulnérabilité MOYENNE (CVSS 5.8) touchant librsync (librsync project).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.9%, plus élevée que 87.2% des vulnérabilités.
Correctif : mettre à jour vers 1.0.0 ou plus récent.

Package	Affected versions	Patched versions
librsync librsync_project	`< 1.0.0`	`1.0.0`

Description

librsync before 1.0.0 uses a truncated MD4 checksum to match blocks, which makes it easier for remote attackers to modify transmitted data via a birthday attack.

References

lists.fedoraproject.org/pipermail/package-announce/2015-March/151105.html · Mailing List
lists.fedoraproject.org/pipermail/package-announce/2015-March/152355.html · Mailing List
lists.fedoraproject.org/pipermail/package-announce/2015-March/152366.html · Mailing List
lists.opensuse.org/opensuse-updates/2015-10/msg00034.html · Mailing List
openwall.com/lists/oss-security/2014/07/28/1 · Mailing List
openwall.com/lists/oss-security/2014/08/05/5 · Mailing List
openwall.com/lists/oss-security/2014/10/13/2 · Mailing List
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
librsync/librsync · Patch
librsync/librsync release v1.0.0 · Patch
security.gentoo.org/glsa/201605-04 · Third Party Advisory
miknet.net/security/optimizing-birthday-attack · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free