Skip to content

Commit 2799c94

Browse files
Explicitly mentioned which version of rsync has the --trust-sender flag
1 parent e631929 commit 2799c94

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

docs/requirements.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ Backup host software requirements are modest: Linux or other modern Unix operati
1212

1313
The [recent fix in rsync `3.2.5`](https://github.com/WayneD/rsync/blob/master/NEWS.md#news-for-rsync-325-14-aug-2022) for [CVE-2022-29154](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29154) causes severe performance impacts on backup-utils.
1414

15-
These impacts can be mitigated by using the `--trust-sender` flag with rsync. Unfortunately some Linux distributions have backported the fix for this CVE to their rsync package without also backporting the `--trust-sender` flag. If your backup host is running on an operating system in this situation (i.e. the CVE fix has been backported but the `--trust-sender` flag has not) you have three options:
15+
These impacts can be mitigated by using the `--trust-sender` flag with rsync; this flag is available from v3.2.5 onwards. Unfortunately some Linux distributions have backported the fix for this CVE to their rsync package without also backporting the `--trust-sender` flag. If your backup host is running on an operating system in this situation (i.e. the CVE fix has been backported but the `--trust-sender` flag has not) you have three options:
1616

1717
1. Downgrade (using the package manager on your host) the rsync package to a version before the CVE fix was backported
1818
2. Upgrade (using the package manager on your host) the rsync package to v3.2.5 or newer

0 commit comments

Comments
 (0)