CVE-2020-14387

A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.

A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.

Se encontró un fallo en rsync en versiones desde 3.2.0pre1. Rsync comprueba inapropiadamente el certificado con vulnerabilidad de discrepancia de host. Un atacante remoto no autenticado podría explotar el fallo llevando a cabo un de tipo ataque de tipo man-in-the-middle usando un certificado válido para otro nombre de host que podría comprometer la confidencialidad e integridad de los datos transmitidos usando rsync-ssl. La mayor amenaza de esta vulnerabilidad es la confidencialidad e integridad de los datos. Este fallo afecta a rsync versiones anteriores a 3.2.4