CVE record · CVE-2024-12085

Rsync: info leak via uninitialized stack contents

CVSS 7.5 HighEPSS 0.086 · 95th percentile

Published by the CVE Program (CNA: redhat) at 14 Jan 2025, 17:37 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Not given	Not given Package name: rsync https://github.com/RsyncProject/rsync	affected 3.3.0 and earlier semver Other versions: unaffected
Red Hat	Red Hat Enterprise Linux 10 Package name: rsync https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.4.1-2.el10 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION Package name: rsync https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.0.6-12.el6_10.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support Package name: rsync https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.1.2-12.el7_9.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8 Package name: rsync https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.1.3-20.el8_10 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support Package name: rsync https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.1.3-7.el8_2.3 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Package name: rsync https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.1.3-12.el8_4.3 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service Package name: rsync https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.1.3-12.el8_4.3 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Package name: rsync https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.1.3-12.el8_4.3 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Package name: rsync https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.1.3-14.el8_6.6 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service Package name: rsync https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.1.3-14.el8_6.6 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Package name: rsync https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.1.3-14.el8_6.6 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support Package name: rsync https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.1.3-20.el8_8.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9 Package name: rsync https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.2.3-20.el9_5.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9 Package name: rsync https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.2.3-20.el9_5.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Package name: rsync https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.2.3-9.el9_0.3 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support Package name: rsync https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.2.3-19.el9_2.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support Package name: rsync https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.2.3-19.el9_4.1 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.12 Package name: openshift/ose-rhel-coreos-8 https://catalog.redhat.com/software/containers/	unaffected 412.86.202502100314-0 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.13 Package name: openshift/ose-rhel-coreos-9 https://catalog.redhat.com/software/containers/	unaffected 413.92.202503112237-0 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.14 Package name: openshift/ose-rhel-coreos-9 https://catalog.redhat.com/software/containers/	unaffected 414.92.202502111902-0 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.15 Package name: openshift/ose-rhel-coreos-9 https://catalog.redhat.com/software/containers/	unaffected 415.92.202501281917-0 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.16 Package name: openshift4/ose-ansible-rhel9-operator https://catalog.redhat.com/software/containers/	unaffected v4.16.0-202501311735.p0.g2cb0020.assembly.stream.el9 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.16 Package name: openshift4/ose-helm-rhel9-operator https://catalog.redhat.com/software/containers/	unaffected v4.16.0-202501311933.p0.g4246d04.assembly.stream.el9 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.16 Package name: openshift4/ose-operator-sdk-rhel9 https://catalog.redhat.com/software/containers/	unaffected v4.16.0-202501311605.p0.g4246d04.assembly.stream.el9 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.17 Package name: openshift/ose-rhel-coreos-9 https://catalog.redhat.com/software/containers/	unaffected 417.94.202502051822-0 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.18 Package name: openshift4/aws-kms-encryption-provider-rhel9 https://catalog.redhat.com/software/containers/	unaffected v4.18.0-202501230001.p0.g088dcaf.assembly.stream.el9 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.18 Package name: openshift4/azure-kms-encryption-provider-rhel9 https://catalog.redhat.com/software/containers/	unaffected v4.18.0-202501230001.p0.gd4fb1b6.assembly.stream.el9 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.18 Package name: openshift4/azure-service-rhel9-operator https://catalog.redhat.com/software/containers/	unaffected v4.18.0-202501230001.p0.g11ced00.assembly.stream.el9 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.18 Package name: openshift4/cloud-network-config-controller-rhel9 https://catalog.redhat.com/software/containers/	unaffected v4.18.0-202501230001.p0.gf648c78.assembly.stream.el9 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.18 Package name: openshift4/container-networking-plugins-microshift-rhel9 https://catalog.redhat.com/software/containers/	unaffected v4.18.0-202501230001.p0.g24a6532.assembly.stream.el9 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.18 Package name: openshift4/driver-toolkit-rhel9 https://catalog.redhat.com/software/containers/	unaffected v4.18.0-202502100301.p0.g2e139ed.assembly.stream.el9 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.18 Package name: openshift4/egress-router-cni-rhel9 https://catalog.redhat.com/software/containers/	unaffected v4.18.0-202501230001.p0.g3193a75.assembly.stream.el9 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.18 Package name: openshift4/frr-rhel9 https://catalog.redhat.com/software/containers/	unaffected v4.18.0-202502041302.p0.g1ad8f2e.assembly.stream.el9 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.18 Package name: openshift4/insights-runtime-exporter-rhel9 https://catalog.redhat.com/software/containers/	unaffected v4.18.0-202501230001.p0.g7149f2d.assembly.stream.el9 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.18 Package name: openshift4/insights-runtime-extractor-rhel9 https://catalog.redhat.com/software/containers/	unaffected v4.18.0-202501230001.p0.g7149f2d.assembly.stream.el9 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.18 Package name: openshift4/kube-metrics-server-rhel9 https://catalog.redhat.com/software/containers/	unaffected v4.18.0-202501230001.p0.g962ccca.assembly.stream.el9 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.18 Package name: openshift4/kubevirt-csi-driver-rhel9 https://catalog.redhat.com/software/containers/	unaffected v4.18.0-202501230001.p0.gba2234b.assembly.stream.el9 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.18 Package name: openshift4/network-tools-rhel9 https://catalog.redhat.com/software/containers/	unaffected v4.18.0-202502111035.p0.gf76635f.assembly.stream.el9 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.18 Package name: openshift4/oc-mirror-plugin-rhel9 https://catalog.redhat.com/software/containers/	unaffected v4.18.0-202502100934.p0.gc00c7c9.assembly.stream.el9 to before * rpm Other versions: affected

And 206 more products. The full list is on the CVE record.

Identifiers: CVE-2024-12085
CNA: redhat
Weakness (CWE): CWE-908
Tags: Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION
Red Hat Enterprise Linux 7 Extended Lifecycle Support
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 8.2 Advanced Update Support
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Red Hat Enterprise Linux 8.4 Telecommunications Update Service
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
Memory corruption
Published: 14 Jan 2025
Updated: 13 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
7.5	High	3.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	CNA (redhat)

CISA KEV Not listed.
EPSS 0.086, the 95th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 14 Jan 2025. New records show when each source confirmed them.

Sources

References from the CNA

access.redhat.com/errata/RHBA-2025:6470 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2024:6122 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:0324 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:0325 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:0637 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:0688 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:0714 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:0774 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:0787 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:0790 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:0849 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:0884 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:0885 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:1120 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:1123 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:1128 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:1225 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:1227 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:1242 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:1451 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:21885 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:2701 vendor-advisoryredhat
access.redhat.com/security/cve/CVE-2024-12085 vdb-entryredhat
bugzilla.redhat.com/show_bug.cgi?id=2330539 issue-trackingredhat
kb.cert.org/vuls/id/952657

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.