Comment by jmclnx
16 days ago
Slackware sent a fixed version of rsync out yesterday.
But I wonder of OpenBSD's openrsync has the same issue ? Or did that version avoid the issues when it was created ?
If it was avoided, seems OpenBSD was ahead of the curve again.
openrsync is a neat story, it was made because they wanted to use rsync in the rpki system, but the standards body balked, saying they should not be using something where the standard was the implementation, so the openbsd folk(specifically Kristaps Dzonsons) stepped up and made a second rsync implementation so that the standards body could accept the protocol.
http://man.openbsd.org/rpki-client
Debian issued a security update too:
I'm running several Linux distros and package updates to rsync version 3.2.7 have showed up on all of them already. I can't comment on openrsync.
Given the more permissive license openrsync would be in a pickle if they stole the vulnerable GPL code and claimed to redistribute it under BSD license instead of reimplementing the protocol.
Which is highly unlikely to happen in openbsd.