A few days ago (on January 14 2025), the rsync package received important security updates, which fixed serious and critical vulnerabilities.
Unfortunately the fixes also introduced a regression, affecting scripts using rsync, including the widely used rsnapshot backup method.
Several vulnerabilities were found in rsync. The Debian relevant security announcement, DSA-5843-1, references multiple CVE vulnerabilities.
In Debian Stable (12/Bookworm) the security vulnerabilities were fixed in a new release 3.2.7-1+deb12u1.
Ubuntu often relies on Debian fixes and applied the same fixes. In Ubuntu's latest LTS (24.04/Noble) the fixes were released in version 3.2.7-1ubuntu1.1. The Ubuntu changelog highlights the security fixes:
On Linux Mint (based on Ubuntu), the same security update showed up in the update manager:
So far, so good. Fixing vulnerabilities is important!
Shortly after the rsync update was installed, certain scripts and other programs relying on rsync in the background (such as rsnapshot) stopped working and ran into errors.
Here's an example from a rsnapshot output, running on Ubuntu 24.04 with rsync 3.2.7-1ubuntu1.1:
root@backupserver:~# rsnapshot -c /etc/rsnapshot/remote.example.com-rsnapshot.conf hourly
[...]
mkdir -m 0755 -p /backups/remote.example.com/hourly.0/
/usr/bin/rsync -aH --delete --numeric-ids --relative --delete-excluded \
--rsync-path=/opt/rsnapshot_wrappers/rsync_sudo.sh --exclude=var/session \
--exclude=wp-content/cache --exclude=var/backups --exclude=nohup.out \
--exclude=*.webp --exclude=*.wpress --rsh=/usr/bin/ssh \
--link-dest=/backups/remote.example.com/hourly.1// \
rsnapshot@remote.example.com:/etc/ \
/backups/remote.example.com/hourly.0//
Internal hashtable error: illegal key supplied!
rsync error: errors with program diagnostics (code 13) at hashtable.c(88) [generator=3.2.7]
rsync error: received SIGUSR1 (code 19) at main.c(1613) [Receiver=3.2.7]
Internal hashtable error: illegal key supplied!
rsync error: errors with program diagnostics (code 13) at hashtable.c(88) [generator=3.2.7]
rsync error: received SIGUSR1 (code 19) at main.c(1613) [receiver=3.2.7]
----------------------------------------------------------------------------
Luckily it did not take long and the regression was reported and a new rsync package was announced and released two days later (January 16 2025).
On Debian 12 the regression was fixed in rsync package 3.2.7-1+deb12u2.
In Ubuntu 24.04 the regression was fixed in rsync_3.2.7-1ubuntu1.2.
After installing the latest version of rsync I can confirm that the rsnapshot backups are running correctly again - without having to adjust the rsnapshot configuration.
AWS Android Ansible Apache Apple Atlassian BSD Backup Bash Bluecoat CMS Chef Cloud Coding Consul Containers CouchDB DB DNS Database Databases Docker ELK Elasticsearch Filebeat FreeBSD Galera Git GlusterFS Grafana Graphics HAProxy HTML Hacks Hardware Icinga Influx Internet Java KVM Kibana Kodi Kubernetes LVM LXC Linux Logstash Mac Macintosh Mail MariaDB Minio MongoDB Monitoring Multimedia MySQL NFS Nagios Network Nginx OSSEC OTRS Observability Office OpenSearch PGSQL PHP Perl Personal PostgreSQL Postgres PowerDNS Proxmox Proxy Python Rancher Rant Redis Roundcube SSL Samba Seafile Security Shell SmartOS Solaris Surveillance Systemd TLS Tomcat Ubuntu Unix VMWare VMware Varnish Virtualization Windows Wireless Wordpress Wyse ZFS Zoneminder