SECURITY notice: Please upgrade your rsync package ASAP

Creating a bug report/issue

I have searched the existing open and closed issues

Required Information

  • DietPi version:
G_DIETPI_VERSION_CORE=9
G_DIETPI_VERSION_SUB=9
G_DIETPI_VERSION_RC=0
  • Distro version | bookworm 0
  • Kernel version | Linux pipi 6.1.21-v8+
  • Architecture | arm64
  • SBC model | RPi 4 Model B (aarch64)

Steps to reproduce

Login to dietpie installation via ssh shows the greeter:

 ─────────────────────────────────────────────────────
 DietPi v9.9.0 : 16:38 - Thu 01/30/25
 ─────────────────────────────────────────────────────
 - Device model : RPi 4 Model B (aarch64)
 - CPU temp : 43 °C / 109 °F : Optimal temperature
 - LAN IP : 192.168.178.40 (eth0)
 - MOTD : SECURITY notice: Please upgrade your rsync package ASAP:
          apt update; apt upgrade
          https://lists.debian.org/debian-security-announce/2025/msg00004.html
 ─────────────────────────────────────────────────────

It warns about a security vulnerability in rsync. I tried to run an update, but it didn’t find any packages to update except one which is held back: rpi-eeprom/stable 27.0-1 all [upgradable from: 24.0-1].

So no upgrade for rsync.

rsync is installed in version 3.2.7
uninstalling and re-installing after sudo apt update installs again version 3.2.7.

According to the CVE “versions 3.3.0 and below has been found with SIX serious vulnerabilities”.

1 Like

See https://metadata.ftp-master.debian.org/changelogs//main/r/rsync/rsync_3.2.7-1+deb12u2_changelog

Should be addressed in rsync (3.2.7-1+deb12u1) bookworm-security

Package is maintained by Debian package maintainer globally and not by DietPi project