ikuvumela ukuthi uvumelanise amafayela nezikhombisi phakathi kwemishini emibili kunethiwekhi noma phakathi kwezindawo ezimbili emshinini ofanayo
Ithuluzi lokuvumelanisa amafayela elidumile i-Rsync likhiphe inguqulo yalo elindelwe kakhulu engu-3.5.0, eza ngemuva kwezinyanga eziningana zokuthuthukiswa okuqhubekayo kanye nokuhlolwa okuphelele. Lokhu kubuyekezwa kubekwe njengenye yezinto ezibaluleke kakhulu emlandweni wamuva wephrojekthi.
Umzamo wokubambisana phakathi kwabaphathi kanye nomphakathi wocwaningo uholele ekulungisweni kwamaphutha amaningi abalulekile okuphepha, kwachazwa kabusha indlela uhlelo olusingatha ngayo ukuxazululwa kwendlela, ukuqinisekiswa kokufinyelela, kanye nezixhumanisi ezingokomfanekiso ngesikhathi sokusebenza kokudlulisa.
Izindaba eziyinhloko ze-Rsync 3.5.0
Ukukhishwa kwe -Rsync 3.5.0 kubhekana namaphutha okulawula ukufinyelela okuqondile kanye nokwenza . Esinye seziphazamiso ezinkulu kakhulu esincishisiwe yi-CVE-2026-53791 , ubuthakathaka ekusetshenzisweni kwephrothokholi yommeleli = imodi yangempela. Ngaphambilini, umhlaseli wayengasungula uxhumano oluqondile futhi aqhathe ikheli lakhe le-IP ngokulawula ikhanda le-PROXY, ngaleyo ndlela edlula imithetho yokuvinjelwa kokufinyelela kwe-daemon. Ngesibuyekezo esisha, uhlelo luvimba noma yikuphi ukuxhumana kommeleli okungenayo ngaphandle kokuthi uhlu olucacile oluchaziwe kusiqondiso se-proxy protocol hosts.
Ngesikhathi esifanayo, ukubekeka engozini kokufakwa komyalo okuyingozi, okuhlonzwe njenge-CVE-2026-53790, kwalungiswa. Leli phutha lenzeke ngoba uhlelo aluzange lubalekele amanani angaphandle kahle lapho lusebenzisa imiyalo ngokusebenzisa iziguquguquko zemvelo (njenge-RSYNC_CONNECT_PROG), abaphathi be-exec, noma imvelo ye-rsync-ssl. Ngokwamukela amanani angaqinisekisiwe njengegama le-host noma igama le-module, umenzi ononya angaphoqa ukwenziwa kwemiyalo engafanele ohlelweni lwe-host.
Ukuvikelwa ekuxhumaneni okungokomfanekiso kanye nokufinyelela okungaphandle kwemingcele
Ezinye izilungiso ezifakiwe kulezi zixhumanisi ezingokomfanekiso zekheli lokukhishwa, ezazimelela i-vector yokuhlasela enkulu kunazo zonke eqondiswe kuyo, ihlanganisa ubuthakathaka obuyishumi nanye obuhlobene nalokhu kuziphatha. Lawa maphutha avumela umsebenzisi wendawo onamalungelo alinganiselwe ukuthi akhohlise inqubo ye-rsync ukuze afunde (CVE-2026-53802) noma abhale (CVE-2026-53803) amafayela angahleliwe ngaphandle kwesiqondisi esibekiwe, aze adlule ngisho nezindawo ze-chroot. Isibonelo, ngokufaka ngokushesha ifayela lelogi eliqondiwe ngesixhumanisi ku-/root/.ssh/authorized_keys, umhlaseli angafaka iziqinisekiso zakhe ku-akhawunti yomlawuli.
Ukuze kuqedwe lokhu kuhlaselwa okusekelwe emjahweni (i-TOCTOU), ithimba lihlanganise ukuphathwa kwezixhumanisi ezingokomfanekiso kuzo zonke izinkundla . Ukuqinisekiswa manje kwenziwa ngokuxazulula ingxenye ngayinye yendlela ngokulandelana nangokuphephile, okudinga ukuthi izixhumanisi ezingokomfanekiso eziqondisweni zendawo zibe ngezomsebenzisi wamanje noma umphathi (impande).
Ubuthakathaka obubucayi buphinde balungiswa ku-rrsync (CVE-2026-53783), okwaqinisekisa indlela bese kwenza ukuvumelanisa ngegama elifanayo, kwavula iwindi lesikhathi umhlaseli alisebenzise ukufaka isixhumanisi esingokomfanekiso esidlula isiqondisi sesisekelo esivunyelwe.
Ukulungiswa kwememori kanye nokumelana nokuhlaselwa kokunqatshelwa kwenkonzo
Lesi sibuyekezo sihlanganisa nama-patches obuthakathaka bokonakala kwememori , njengokubhala kwe-out-of-buffer. Abathuthukisi babhekane ne -CVE-2026-70461, lapho uhlelo lungazinaki khona usayizi wokubuyela emuva kwemithetho yokuhlunga enikezwe yiqembu lesithathu, kanye ne-CVE-2026-70456, okubangele ukwehluleka kwememori ye-heap ngokungazinaki uhlamvu olungenalutho ngesikhathi sokuhlaziya okuboshelwe impikiswano yomyalo.
Uhlelo luphinde lwathuthukisa ukuzivikela kwalo emaqhingeni aklanyelwe ukuqeda izinsiza zeseva ( Denial of Service – DoS ). Izimo ezibucayi, njengalezo ezibikwe ngaphansi kwezihlonzi ze-CVE-2026-70453 kanye ne-CVE-2026-70464, lapho ukuthumela amapharamitha angaphelele, izintambo eziguquliwe, noma ukucushwa okweqile (njengokwabiwa kabi kwezintambo ze-Zstandard) kuphoqe umkhawulo wokuxhumeka kweseva ngesikhathi esifanayo noma kuqede amandla okucubungula e-CPU, sekuxazululiwe, ngaleyo ndlela kuzinzisa i-daemon ye-Rsync ezindaweni zokukhiqiza.
Unesifiso sokufunda kabanzi ngale nguqulo entsha? Ungathola imininingwane kusixhumanisi esilandelayo.
Ungayifaka kanjani i-Rsync ku-Linux?
Kulabo abanentshisekelo yokukwazi ukufaka leli thuluzi kusistimu yabo, bangakwenza lokho ngokufaka iphakheji elinikezwa ngaphakathi kwamakhosombe wokusatshalaliswa kweLinux okuningi.
Kulabo abasebenzisa i -Debian, Ubuntu noma yikuphi okuphuma kukho, vele uvule i-terminal bese uthayipha okulandelayo:
sudo apt ukufaka rsync
Manje, kulabo abangabasebenzisi beFedora:
sudo dnf faka rsync
Kanti kulabo abangabasebenzisi be- Arch Linux nanoma yikuphi okuphuma kukho:
sudo pacman -S rsync
Ngokuphathelene nalabo abangabasebenzisi be-openSUSE:
sudo zypper ku-rsync