{
	"document":{
		"aggregate_severity":{
			"namespace":"https://nvd.nist.gov/vuln-metrics/cvss",
			"text":"Medium"
		},
		"category":"csaf_vex",
		"csaf_version":"2.0",
		"distribution":{
			"tlp":{
				"label":"WHITE",
				"url":"https:/www.first.org/tlp/"
			}
		},
		"lang":"en",
		"notes":[
			{
				"text":"rsync security update",
				"category":"general",
				"title":"Synopsis"
			},
			{
				"text":"An update for rsync is now available for openEuler-24.03-LTS",
				"category":"general",
				"title":"Summary"
			},
			{
				"text":"Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\n\nSecurity Fix(es):\n\nA malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The \n\nmalicious \n\nrsync client requires at least read access to the remote rsync module in order to trigger the issue.(CVE-2025-10158)",
				"category":"general",
				"title":"Description"
			},
			{
				"text":"An update for rsync is now available for openEuler-24.03-LTS.\n\nopenEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.",
				"category":"general",
				"title":"Topic"
			},
			{
				"text":"Medium",
				"category":"general",
				"title":"Severity"
			},
			{
				"text":"rsync",
				"category":"general",
				"title":"Affected Component"
			}
		],
		"publisher":{
			"issuing_authority":"openEuler security committee",
			"name":"openEuler",
			"namespace":"https://www.openeuler.org",
			"contact_details":"openeuler-security@openeuler.org",
			"category":"vendor"
		},
		"references":[
			{
				"summary":"openEuler-SA-2026-1176",
				"category":"self",
				"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1176"
			},
			{
				"summary":"CVE-2025-10158",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-10158&packageName=rsync"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10158"
			},
			{
				"summary":"openEuler-SA-2026-1176 vex file",
				"category":"self",
				"url":"https://repo.openeuler.org/security/data/csaf/advisories/2026/csaf-openeuler-sa-2026-1176.json"
			}
		],
		"title":"An update for rsync is now available for openEuler-24.03-LTS",
		"tracking":{
			"initial_release_date":"2026-01-22T09:59:48+08:00",
			"revision_history":[
				{
					"date":"2026-01-22T09:59:48+08:00",
					"summary":"Initial",
					"number":"1.0.0"
				}
			],
			"generator":{
				"date":"2026-01-22T09:59:48+08:00",
				"engine":{
					"name":"openEuler CSAF Tool V1.0"
				}
			},
			"current_release_date":"2026-01-22T09:59:48+08:00",
			"id":"openEuler-SA-2026-1176",
			"version":"1.0.0",
			"status":"final"
		}
	},
	"product_tree":{
		"branches":[
			{
				"name":"openEuler",
				"category":"vendor",
				"branches":[
					{
						"name":"openEuler",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
									},
									"product_id":"openEuler-24.03-LTS",
									"name":"openEuler-24.03-LTS"
								},
								"name":"openEuler-24.03-LTS",
								"category":"product_version"
							}
						],
						"category":"product_name"
					},
					{
						"name":"aarch64",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
									},
									"product_id":"rsync-3.2.7-7.oe2403.aarch64.rpm",
									"name":"rsync-3.2.7-7.oe2403.aarch64.rpm"
								},
								"name":"rsync-3.2.7-7.oe2403.aarch64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
									},
									"product_id":"rsync-debuginfo-3.2.7-7.oe2403.aarch64.rpm",
									"name":"rsync-debuginfo-3.2.7-7.oe2403.aarch64.rpm"
								},
								"name":"rsync-debuginfo-3.2.7-7.oe2403.aarch64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
									},
									"product_id":"rsync-debugsource-3.2.7-7.oe2403.aarch64.rpm",
									"name":"rsync-debugsource-3.2.7-7.oe2403.aarch64.rpm"
								},
								"name":"rsync-debugsource-3.2.7-7.oe2403.aarch64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
									},
									"product_id":"rsync-help-3.2.7-7.oe2403.aarch64.rpm",
									"name":"rsync-help-3.2.7-7.oe2403.aarch64.rpm"
								},
								"name":"rsync-help-3.2.7-7.oe2403.aarch64.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					},
					{
						"name":"src",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
									},
									"product_id":"rsync-3.2.7-7.oe2403.src.rpm",
									"name":"rsync-3.2.7-7.oe2403.src.rpm"
								},
								"name":"rsync-3.2.7-7.oe2403.src.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					},
					{
						"name":"x86_64",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
									},
									"product_id":"rsync-3.2.7-7.oe2403.x86_64.rpm",
									"name":"rsync-3.2.7-7.oe2403.x86_64.rpm"
								},
								"name":"rsync-3.2.7-7.oe2403.x86_64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
									},
									"product_id":"rsync-debuginfo-3.2.7-7.oe2403.x86_64.rpm",
									"name":"rsync-debuginfo-3.2.7-7.oe2403.x86_64.rpm"
								},
								"name":"rsync-debuginfo-3.2.7-7.oe2403.x86_64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
									},
									"product_id":"rsync-debugsource-3.2.7-7.oe2403.x86_64.rpm",
									"name":"rsync-debugsource-3.2.7-7.oe2403.x86_64.rpm"
								},
								"name":"rsync-debugsource-3.2.7-7.oe2403.x86_64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
									},
									"product_id":"rsync-help-3.2.7-7.oe2403.x86_64.rpm",
									"name":"rsync-help-3.2.7-7.oe2403.x86_64.rpm"
								},
								"name":"rsync-help-3.2.7-7.oe2403.x86_64.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					}
				]
			}
		],
		"relationships":[
			{
				"relates_to_product_reference":"openEuler-24.03-LTS",
				"product_reference":"rsync-3.2.7-7.oe2403.aarch64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS:rsync-3.2.7-7.oe2403.aarch64",
					"name":"rsync-3.2.7-7.oe2403.aarch64 as a component of openEuler-24.03-LTS"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS",
				"product_reference":"rsync-debuginfo-3.2.7-7.oe2403.aarch64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS:rsync-debuginfo-3.2.7-7.oe2403.aarch64",
					"name":"rsync-debuginfo-3.2.7-7.oe2403.aarch64 as a component of openEuler-24.03-LTS"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS",
				"product_reference":"rsync-debugsource-3.2.7-7.oe2403.aarch64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS:rsync-debugsource-3.2.7-7.oe2403.aarch64",
					"name":"rsync-debugsource-3.2.7-7.oe2403.aarch64 as a component of openEuler-24.03-LTS"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS",
				"product_reference":"rsync-help-3.2.7-7.oe2403.aarch64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS:rsync-help-3.2.7-7.oe2403.aarch64",
					"name":"rsync-help-3.2.7-7.oe2403.aarch64 as a component of openEuler-24.03-LTS"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS",
				"product_reference":"rsync-3.2.7-7.oe2403.src.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS:rsync-3.2.7-7.oe2403.src",
					"name":"rsync-3.2.7-7.oe2403.src as a component of openEuler-24.03-LTS"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS",
				"product_reference":"rsync-3.2.7-7.oe2403.x86_64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS:rsync-3.2.7-7.oe2403.x86_64",
					"name":"rsync-3.2.7-7.oe2403.x86_64 as a component of openEuler-24.03-LTS"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS",
				"product_reference":"rsync-debuginfo-3.2.7-7.oe2403.x86_64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS:rsync-debuginfo-3.2.7-7.oe2403.x86_64",
					"name":"rsync-debuginfo-3.2.7-7.oe2403.x86_64 as a component of openEuler-24.03-LTS"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS",
				"product_reference":"rsync-debugsource-3.2.7-7.oe2403.x86_64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS:rsync-debugsource-3.2.7-7.oe2403.x86_64",
					"name":"rsync-debugsource-3.2.7-7.oe2403.x86_64 as a component of openEuler-24.03-LTS"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS",
				"product_reference":"rsync-help-3.2.7-7.oe2403.x86_64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS:rsync-help-3.2.7-7.oe2403.x86_64",
					"name":"rsync-help-3.2.7-7.oe2403.x86_64 as a component of openEuler-24.03-LTS"
				},
				"category":"default_component_of"
			}
		]
	},
	"vulnerabilities":[
		{
			"cve":"CVE-2025-10158",
			"notes":[
				{
					"text":"A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The \n\nmalicious \n\nrsync client requires at least read access to the remote rsync module in order to trigger the issue.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-24.03-LTS:rsync-3.2.7-7.oe2403.aarch64",
					"openEuler-24.03-LTS:rsync-debuginfo-3.2.7-7.oe2403.aarch64",
					"openEuler-24.03-LTS:rsync-debugsource-3.2.7-7.oe2403.aarch64",
					"openEuler-24.03-LTS:rsync-help-3.2.7-7.oe2403.aarch64",
					"openEuler-24.03-LTS:rsync-3.2.7-7.oe2403.src",
					"openEuler-24.03-LTS:rsync-3.2.7-7.oe2403.x86_64",
					"openEuler-24.03-LTS:rsync-debuginfo-3.2.7-7.oe2403.x86_64",
					"openEuler-24.03-LTS:rsync-debugsource-3.2.7-7.oe2403.x86_64",
					"openEuler-24.03-LTS:rsync-help-3.2.7-7.oe2403.x86_64"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-24.03-LTS:rsync-3.2.7-7.oe2403.aarch64",
						"openEuler-24.03-LTS:rsync-debuginfo-3.2.7-7.oe2403.aarch64",
						"openEuler-24.03-LTS:rsync-debugsource-3.2.7-7.oe2403.aarch64",
						"openEuler-24.03-LTS:rsync-help-3.2.7-7.oe2403.aarch64",
						"openEuler-24.03-LTS:rsync-3.2.7-7.oe2403.src",
						"openEuler-24.03-LTS:rsync-3.2.7-7.oe2403.x86_64",
						"openEuler-24.03-LTS:rsync-debuginfo-3.2.7-7.oe2403.x86_64",
						"openEuler-24.03-LTS:rsync-debugsource-3.2.7-7.oe2403.x86_64",
						"openEuler-24.03-LTS:rsync-help-3.2.7-7.oe2403.x86_64"
					],
					"details":"rsync security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1176"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"MEDIUM",
						"baseScore":4.3,
						"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
						"version":"3.1"
					},
					"products":[
						"openEuler-24.03-LTS:rsync-3.2.7-7.oe2403.aarch64",
						"openEuler-24.03-LTS:rsync-debuginfo-3.2.7-7.oe2403.aarch64",
						"openEuler-24.03-LTS:rsync-debugsource-3.2.7-7.oe2403.aarch64",
						"openEuler-24.03-LTS:rsync-help-3.2.7-7.oe2403.aarch64",
						"openEuler-24.03-LTS:rsync-3.2.7-7.oe2403.src",
						"openEuler-24.03-LTS:rsync-3.2.7-7.oe2403.x86_64",
						"openEuler-24.03-LTS:rsync-debuginfo-3.2.7-7.oe2403.x86_64",
						"openEuler-24.03-LTS:rsync-debugsource-3.2.7-7.oe2403.x86_64",
						"openEuler-24.03-LTS:rsync-help-3.2.7-7.oe2403.x86_64"
					]
				}
			],
			"threats":[
				{
					"details":"Medium",
					"category":"impact"
				}
			],
			"title":"CVE-2025-10158"
		}
	]
}