{"id":1445,"date":"2026-08-13T15:30:00","date_gmt":"2026-08-13T15:30:00","guid":{"rendered":"https:\/\/netguide.io\/news\/2026\/08\/13\/rsync-3-5-behebt-33-sicherheitsluecken\/"},"modified":"2026-08-17T23:12:28","modified_gmt":"2026-08-17T23:12:28","slug":"rsync-3-5-behebt-33-sicherheitsluecken","status":"publish","type":"post","link":"https:\/\/netguide.io\/news\/de\/2026\/08\/13\/rsync-3-5-behebt-33-sicherheitsluecken\/","title":{"rendered":"Rsync 3.5 behebt 33 Sicherheitsl\u00fccken auf einmal"},"content":{"rendered":"<div id=\"netgu-4030734819\" class=\"netgu-before-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"3494115342\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n<p class=\"wp-block-paragraph\"><strong>Vom weit verbreiteten Synchronisations- und Backup-Werkzeug rsync ist am 13. August 2026 Version 3.5 erschienen \u2013 ein au\u00dfergew\u00f6hnliches Update, das auf einen Schlag 33 Sicherheitsl\u00fccken behebt. Wer rsync einsetzt, besonders als Daemon, sollte zeitnah aktualisieren.<\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Die kritische L\u00fccke<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Als kritisch eingestuft ist CVE-2026-53791: Sie betrifft rsync-Daemons, die mit <code>proxy protocol = true<\/code> konfiguriert sind. Ein Client, der sich direkt statt \u00fcber den vorgesehenen vertrauensw\u00fcrdigen Proxy verbindet, konnte einen eigenen PROXY-Header senden und so seine Quell-IP-Adresse f\u00e4lschen.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Symlinks und Pfad-Beschr\u00e4nkung<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Ein gro\u00dfer Teil der \u00fcbrigen \u2013 teils hochstufigen \u2013 Korrekturen dreht sich um die Behandlung von symbolischen Links und die Beschr\u00e4nkung auf zul\u00e4ssige Pfade. Mehrere dieser L\u00fccken h\u00e4tten es Angreifern erm\u00f6glichen k\u00f6nnen, rsync-Operationen aus den vorgesehenen Verzeichnissen umzulenken.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Zus\u00e4tzlich werden Steuerzeichen in Dateinamen nun vor dem Schreiben ins Log escaped, was Terminal- und Log-Injection verhindert. Und rsync-ssl pr\u00fcft bei der Nutzung von stunnel jetzt Zertifikat und Hostname korrekt. Die Fixes stammen aus einem gezielten Audit der Pfad-Verarbeitung und des Daemon-Protokolls, einem begleitenden Fuzzing-Durchlauf sowie Meldungen externer Forscher.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Quellen: <a href=\"https:\/\/linuxiac.com\/rsync-3-5-file-synchronization-tool-released-with-33-security-fixes\/\" target=\"_blank\" rel=\"noopener\">Linuxiac<\/a>, <a href=\"https:\/\/www.phoronix.com\/news\/Rsync-3.5\" target=\"_blank\" rel=\"noopener\">Phoronix<\/a>.<\/em><\/p>\n<div id=\"netgu-199463185\" class=\"netgu-after-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"4559785002\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Rsync 3.5 ist ein au\u00dfergew\u00f6hnliches Sicherheitsupdate: Es schlie\u00dft 33 L\u00fccken, darunter eine kritische IP-Spoofing-Schwachstelle und viele Symlink-Probleme.<\/p>\n","protected":false},"author":1,"featured_media":1534,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[],"tags":[],"class_list":["post-1445","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/1445","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/comments?post=1445"}],"version-history":[{"count":1,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/1445\/revisions"}],"predecessor-version":[{"id":1535,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/1445\/revisions\/1535"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media\/1534"}],"wp:attachment":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media?parent=1445"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/categories?post=1445"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/tags?post=1445"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}