From nobody Fri Jan 17 00:36:08 2025 X-Original-To: questions@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4YZ14Z28HTz5l7yY for ; Fri, 17 Jan 2025 00:36:14 +0000 (UTC) (envelope-from mirror176@hotmail.com) Received: from NAM11-BN8-obe.outbound.protection.outlook.com (mail-bn8nam11olkn2049.outbound.protection.outlook.com [40.92.20.49]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (secp384r1) server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "mail.protection.outlook.com", Issuer "DigiCert Cloud Services CA-1" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4YZ14Y0VHQz3QBR for ; Fri, 17 Jan 2025 00:36:13 +0000 (UTC) (envelope-from mirror176@hotmail.com) Authentication-Results: mx1.freebsd.org; dkim=pass header.d=hotmail.com header.s=selector1 header.b=kJRyO3ou; arc=pass ("microsoft.com:s=arcselector10001:i=1"); spf=pass (mx1.freebsd.org: domain of mirror176@hotmail.com designates 40.92.20.49 as permitted sender) smtp.mailfrom=mirror176@hotmail.com; dmarc=pass (policy=none) header.from=hotmail.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Xnle2nEZsKjV13y+Ho+ugRl9GTmK4Zrqt6u051FubSPH61MIEIMGusJQoNeHaGswxEUZYj+MpdR4tHsXyEnqGbSpTmDlSTBbAeUDRU5XPlkwtpLyO1kl1TLSQxmfQ4AHDdJiGMFN8YcVQdzQaaSdFHRZp8QLPWenjRIptrRb+88Nzt8/mPwruj1OrRIabLZxoxETxvDFpDN0ftbLMI34RNy8Rbxcny1CmG9ryVyGm2hLicyOmt1c3X8DklmvsK9EsaD520p4vO5vwdNrLwn/3+rgQSBgbqMcSKev/9KoW9yQngTOl7e9MgMweqd46A4a2zygCjVQGRApDVIm8sKISw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=0IjuPrXYu9MunFU2fRSZl7R5XefqMQBw8jc1WpnYolk=; b=KcxZJlOH6py6LuNc4leiZVyf3rDgSAqPmL0vFqQC7EqpBM+VeDoVSQc5BsJFyBhV9BR+mcVBZIhZwIrROI6HBhe/wysHCLtAla7WaUFs8soO43G/N5IH0iBB7DrVNcd52Y9kp6fe4/sYkT0o3PkoApQlZ3WkcpfsGYx1qMoQuC3yvN/jJvPelb6MW2S2wX2s9yzs7w7/BvqO1ir8OlnMA/FFEGY/hjmOH1hNEaWJxTSAS2/T3wxkiGdZB30OQN+KNhZBHwF/ox3H+etcLfeXP9753S0sA5+1Glj7FcX2O3zEpY5+x8Qt6PINVhpLfmhMVbgtEuQCD7rUgmWi0GJtog== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=0IjuPrXYu9MunFU2fRSZl7R5XefqMQBw8jc1WpnYolk=; b=kJRyO3ouZ5Mfk0S2DN4bpdRpK8dWa6slTRtUj5iX/pWubfptREqQsLCD5MuhQPJCRrkfjQsip2Cb1LXSmUKXYN+aPov76LSmJNmuNPf2wBl8NKy+xbK0MKg6SdJYfR3J6XI5oOq22/kt4kqj2NMuK9iK8TlNx7DXj7yf1Ud0aUMPGQJFpJ1VR+bIyGgvpnG0LdsfoaUeXADWemk5bnTDAKaSURkD6lcjdLYknOOdwZFSbitMUBEqIIPcZ6tqb7ykuRRyZFABA/vBmV4TuKVs2ytiaBXpjXPTe1vHwuOQioXtgfHLemBohR8L8XqJ2m2kDKjc0Wr9UN3RkbI1mrKelA== Received: from CO1PR11MB4770.namprd11.prod.outlook.com (2603:10b6:303:94::19) by CY5PR11MB6344.namprd11.prod.outlook.com (2603:10b6:930:3b::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8356.13; Fri, 17 Jan 2025 00:36:10 +0000 Received: from CO1PR11MB4770.namprd11.prod.outlook.com ([fe80::bffd:9e35:4afa:a747]) by CO1PR11MB4770.namprd11.prod.outlook.com ([fe80::bffd:9e35:4afa:a747%4]) with mapi id 15.20.8335.017; Fri, 17 Jan 2025 00:36:10 +0000 Message-ID: Date: Thu, 16 Jan 2025 17:36:08 -0700 User-Agent: Mozilla Thunderbird Subject: Re: Serious rsync security issues To: questions@freebsd.org References: Content-Language: en-US From: "Edward Sanford Sutton, III" In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-ClientProxiedBy: BYAPR02CA0045.namprd02.prod.outlook.com (2603:10b6:a03:54::22) To CO1PR11MB4770.namprd11.prod.outlook.com (2603:10b6:303:94::19) X-Microsoft-Original-Message-ID: <9c178454-a8ff-4bc9-8998-cb86b58fb8c1@hotmail.com> List-Id: User questions List-Archive: https://lists.freebsd.org/archives/freebsd-questions List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-questions@freebsd.org Sender: owner-freebsd-questions@FreeBSD.org MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CO1PR11MB4770:EE_|CY5PR11MB6344:EE_ X-MS-Office365-Filtering-Correlation-Id: f9a7b532-6581-45de-86cf-08dd368ef04b X-Microsoft-Antispam: BCL:0;ARA:14566002|7092599003|461199028|19110799003|6090799003|8060799006|5072599009|15080799006|21061999003|12071999003|10035399004|41001999003|440099028|3412199025; X-Microsoft-Antispam-Message-Info: =?utf-8?B?QTByUlQraVpLTEx5RUplUkdHNXFGM0t5RUxQUFpoNGs3QjJtRENwVzl1M0o1?= =?utf-8?B?V2VQNFRwcnk2Mm1Qd2hERGVpeEUwNCs4NExVanNVYkFxU3lTWDBETHB5d1Mr?= =?utf-8?B?UlRUN2pmRWNYMm1tYjFGRjlQLzJJNWgyay9YTEZWQytVOG0yRkJ5WXZPQU9s?= =?utf-8?B?aHh5ODg2cnlhZG5nZjRiRmp5bTU2QjhpaXRacWxWSFZvSVBNZG5Ga3BMc1NV?= =?utf-8?B?M3FacFgvYVFsaFJSMUh0M3NxL3dBbTI0eTZCMDMzV25nNDlkeS91UitjRC9S?= =?utf-8?B?cXBBQTJmUGNEbVQ1dlVFOGFlTDk1dTZuNWVLNWg2eExpYlhHUlBucnVtemwz?= =?utf-8?B?d2l3OHVpZW92ay93ZlZMNUNSWERxeGZyUGZ2Y1o1RnU1cUpLZHQyQ3lUQTV5?= =?utf-8?B?eW04VzlaRXNucFVpc21heHIxY25sV2dLWXJuRnBWSDJRNFlPL3UyREVUSzk5?= =?utf-8?B?ZWVwNDBZUnY0a1JXSmRYUmJtaFM4Y0k2RHIwODdRNlRxS0srWFdPa09RMUR6?= =?utf-8?B?aTJXSXJtTFVHKytzNmZuUGZKTHlTR1pBZjJkWjkwRUlJTEZDckdHcXpzbDhr?= =?utf-8?B?c1l1cVhzRGF4ZFJHUERXM25tSmFuazkwdHJmR2dGVHJtTm5XT1JsYTA0R1JE?= =?utf-8?B?aWRBYkJwZGVLYnVyekJqd1BjamxsNWF6MVY5akhsMXo1QjhkVXAzWjF4enRv?= =?utf-8?B?MEFJTHIrNnUyRE9WelhMNldhM0pyL3hJUnlYWEpZU1haUERkc25kLzJWcmVJ?= =?utf-8?B?YmFMOUZYSWVyVFpBdVZUNlRPNGpLZTFGTVArL0RhcmljOGU1b0E4Q3dtRHJH?= =?utf-8?B?eVgzY1NkaTRjbHo4TXE1V2kzcDIrY1I0VnRlTzhpOURWN0IrTGx4cGJwclkr?= =?utf-8?B?UzRiSHZrMUl6bDBxR1JZTEFKaEJLY0NxVDdpNG8zYWUxcHhUMGZOM3hLcEJW?= =?utf-8?B?SGl1Q2ljbVA5SS8zU3BUK1V4Q2EwejFEdEcxRElvVVd4YWdFNm14OWJFT1Rt?= =?utf-8?B?OERJVU1kMXBXdWdZdDBDSDlWMTFseitrQjQxZm12UmltZmNZTVA5dDV1TEZv?= =?utf-8?B?SW91ckxCM05KMFZsb21lYmthUW1qSVlJdVNLU0dibzBQTG1LbmpoK1ZBNG9K?= =?utf-8?B?UmtGTkk1N3FzR3JpaTgyeFdaNGhvMHhLcFdDaDQxcGxyL1EwVHJ6WGZ0Vncv?= =?utf-8?B?MC9EMk5CM2FJZEhTYkpwMXZLTk9IMTg2dmJyT045Qm90UGlPdzh0NGNwTHgx?= =?utf-8?B?aW9sR0JPZ0RMNUpLbHZyWnlnUU1JMjBFVDl0cEFjMjdrRDhrdGlKbjZXSnRJ?= =?utf-8?B?SVVXOE9GN1QzeUd3Rm5VL1Zyb0ZobVJtc09sSEdGMk0vM0FmNWtxbTZVcEFR?= =?utf-8?B?MHRGWDBmVzNyNnZ0TXBhZkZiOFNHNVFMUWNqeWc5THc3d2svVVJKWitqb2Zq?= =?utf-8?B?djhHWHhYSWdsWTZKMGQ2Z28rYkZhd0h6U0J1djQxN0tuMEVKUnRLMm9RK0Qx?= =?utf-8?B?TjM5R1RxbXpoeE5jbDhQVmFCU1lzdkhXU2UvdGxpTjREc3NUYitYSCtKT0Zl?= =?utf-8?B?c05HSVRxR3hlVEdkYVV2bVVMQmJpaFFGTzh4eEt6VFJrWE1nbFU4Ujh2eTFF?= =?utf-8?B?aUo3Z2pPTkhDN29aVmorYWVRODIxTlZzWjNwQXFiTFljajBIdnBiaXdxRGZ3?= =?utf-8?Q?Yb6fP+E4CTCv1P8xXSbj?= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?UkF0Nmhqa3ZzNUhaS3RkQ0JvaExNcWMwQXhKMStJMGkraDZFWE1QUHF4Z1B0?= =?utf-8?B?SXJRNGlXRWpNMlJHTm9oZis2QXVLNHZtMWNRMEo4dEtXTFdXSXBrTzVTY05J?= =?utf-8?B?MHc2Z3BkU1I2STJkWFdTVkNZcFhDekw5NDNZUGJzb25iL3dwN0h2cFlJM1BS?= =?utf-8?B?ejlNYjNYbTRFM0V5ZFBwSHFsakp3QmUyZUk0b1JMWXdDUEs2aG5PV0ZJUWJI?= =?utf-8?B?OVZ3S3BhMmQzcGN6cENRMDF2N0FJRGJvektQMC9sNGl4Rzl0Y2MxdlFLM1Z0?= =?utf-8?B?WFF2a1J6aGhqc3llMWJUelJXcWlwbklCM0Z2K2sxT25sb3ZJOFZOcjZoV1Za?= =?utf-8?B?VW9KNmJYTXZPeTQrRkFuUkhDTE5BZzNxRmJiU2tjVWVkOFl2bVVQNEl0eTcy?= =?utf-8?B?dzAvU1Jpd3UyQ0V0MFFncWNuMGNPSVNFYjBrTjFoQVhwSHh3UEJyVXlkUCtC?= =?utf-8?B?VkN4bU02Z25QTlA1SE4xT3hzUVFEc1d2Uy8rWDduclRmd1M0T0RPZ1ZtaXBC?= =?utf-8?B?QUttcmY5bXB0SmZoOS9xeVZxdmxacFpqMFJJMlRjTmhTUExGTktlTHJlQWYr?= =?utf-8?B?MmZwYzZwUDdiMndoaE1uRENCbFRFZndyU0J4T3Flek9YUVRxYm5BWEpmemhM?= =?utf-8?B?T0phWHBwTmtLeVM1ZDkraTdodGdHK1lPQ2RRZUlWSXN6MVlJbFVUZzV6ck1G?= =?utf-8?B?N0JRa3lzemdGemtSeklWRUo5dDB4anpTdWtKNE42OUlXVGRDNXRRWjU4c24r?= =?utf-8?B?aGtxUHA2Znl4VnlVM2JQUmlHcXkrTUFaK296dEZBekxZWVk3YlhLcStpTEJT?= =?utf-8?B?U1hmN0pTWGZvUndHSm1BVi9pMEpRZXhuM0U2T3AxVXNqQkgrQlhWWUFaVGNF?= =?utf-8?B?RnR1UXArL1RIODM1SFVaVmpsVmdDZUJCWlJtOXh4QXdJT3ltM0xZS0M3STFH?= =?utf-8?B?MzVuQ3JFWGhPTUYrQzU4L0JXbXhiVFlwK2ZoRWZvVjU1dHhDRGlRRVlwSGRm?= =?utf-8?B?YzNCdldaQS9FWi9rcGphSWhxeUs5ckxvMlQ4RVRjV3dEdFl1ZHJYNzRtV0tX?= =?utf-8?B?Sk1ZcnFnSEpva2RXRk56VVl2SFZhS2NnT1hIck9PS2lFOXIwa1c1QjlqQlFK?= =?utf-8?B?KzVIa1ZFeW80dVR5YXdIRmwrMWlCV1RxUS90OGROdXdyRmNROVdxeVFwQ3lj?= =?utf-8?B?NHJQNjFyb3dxRUs4R2UrYU9MMi9TeEEvYURMR1dyWncrbWd3QkNNelN0b2po?= =?utf-8?B?bWdnSkFZVHdyOWpHcElZdjhPVXdGZWJVeDl4Mlc3NjRwVDFNamQ3NGUyTkpi?= =?utf-8?B?SG4yaW0wcmVJbnpLbGxHZ0k2aDJYTERVU1pPNG94aTU1ckF1cE9wM2p6dlhj?= =?utf-8?B?N201TlFleWxjTHFTSXFTYk1PVzFyK3JOalVFOVdhQjNpaEViTVFsOWo0Qzcx?= =?utf-8?B?SEZOQzVwSHFZQ09tbDhPT21TeExEYitldEt4VUEyT1luTnY1RGoyK3lFTGtU?= =?utf-8?B?aDBXS1ZtRk1UUDNEZEtGRzdrbkZTeG5HL2Uzd0RJVzV5aG4wa1RSZ004T3JX?= =?utf-8?B?d3dza1BuOUl1MXlOSG8yNFB3OFlmeTgyekZrZ1owYmpMandwd3F2d3FnZVhj?= =?utf-8?Q?hp52r69Iti5QhA5dklzJ5QUy3BttDD/lQSu4vCgvVItk=3D?= X-OriginatorOrg: sct-15-20-7719-20-msonline-outlook-1ce3f.templateTenant X-MS-Exchange-CrossTenant-Network-Message-Id: f9a7b532-6581-45de-86cf-08dd368ef04b X-MS-Exchange-CrossTenant-AuthSource: CO1PR11MB4770.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Jan 2025 00:36:10.4431 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY5PR11MB6344 X-Spamd-Result: default: False [-3.50 / 15.00]; FORGED_MUA_THUNDERBIRD_MSGID_UNKNOWN(2.50)[]; RBL_SENDERSCORE_REPUT_9(-1.00)[40.92.20.49:from]; ARC_ALLOW(-1.00)[microsoft.com:s=arcselector10001:i=1]; NEURAL_HAM_LONG(-1.00)[-1.000]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; NEURAL_HAM_SHORT(-1.00)[-1.000]; DMARC_POLICY_ALLOW(-0.50)[hotmail.com,none]; R_SPF_ALLOW(-0.20)[+ip4:40.92.0.0/16]; R_DKIM_ALLOW(-0.20)[hotmail.com:s=selector1]; MIME_GOOD(-0.10)[text/plain]; DWL_DNSWL_NONE(0.00)[hotmail.com:dkim]; TO_MATCH_ENVRCPT_ALL(0.00)[]; FREEMAIL_FROM(0.00)[hotmail.com]; MIME_TRACE(0.00)[0:+]; RCVD_TLS_LAST(0.00)[]; RCPT_COUNT_ONE(0.00)[1]; FROM_HAS_DN(0.00)[]; FREEMAIL_ENVFROM(0.00)[hotmail.com]; RCVD_COUNT_TWO(0.00)[2]; FROM_EQ_ENVFROM(0.00)[]; DKIM_TRACE(0.00)[hotmail.com:+]; TO_DN_NONE(0.00)[]; RWL_MAILSPIKE_POSSIBLE(0.00)[40.92.20.49:from]; MLMMJ_DEST(0.00)[questions@freebsd.org]; ASN(0.00)[asn:8075, ipnet:40.80.0.0/12, country:US]; RCVD_IN_DNSWL_NONE(0.00)[40.92.20.49:from] X-Spamd-Bar: --- X-Rspamd-Queue-Id: 4YZ14Y0VHQz3QBR On 1/16/25 16:02, Martin wrote: > I am going to point this to the message on the Arch Linux site, > but it's all over the net. > > https://archlinux.org/news/critical-rsync-security-release-340/ > > I am wondering why the FreeBSD rsync package been updated yet? > > https://www.vuxml.org/freebsd/163edccf-d2ba-11ef-b10e-589cfc10a551.html sounds like the entry that brings those CVEs up. There was a bug when it was initially added but since been fixed though I think it would still fail `pkg audit` even with the first entry (-F flag will update the database). It is saying >=3.4.0 is fine which seems to match what https://download.samba.org/pub/rsync/NEWS#3.4.0 says. Both quarterly and latest ports branches have it so packages should arrive on the next successful build from buildservers if it is not there now. As stated previously, you can always build from ports if you need it built sooner than the servers do it.