<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div style="margin: 0px; font-size: 12pt; font-family: Calibri, Arial, Helvetica, sans-serif; color: black; background-color: rgb(255, 255, 255)">
Hi,</div>
<div style="margin: 0px; font-size: 12pt; font-family: Calibri, Arial, Helvetica, sans-serif; color: black; background-color: rgb(255, 255, 255)">
<br>
</div>
<div style="margin: 0px; font-size: 12pt; font-family: Calibri, Arial, Helvetica, sans-serif; color: black; background-color: rgb(255, 255, 255)">
There is a security issue in rsync that needs to be disclosed to the team. Similar issues in other tools have CVEs of high severity assigned to them, and rsync has such an issue as well.</div>
<div style="margin: 0px; font-size: 12pt; font-family: Calibri, Arial, Helvetica, sans-serif; color: black; background-color: rgb(255, 255, 255)">
<br>
</div>
<div style="margin: 0px; font-size: 12pt; font-family: Calibri, Arial, Helvetica, sans-serif; color: black; background-color: rgb(255, 255, 255)">
I would like to enable the rsync maintainers to be aware of, and hopefully to fix the issue. I know of it since about 15 years back and assume it has been there more or less from the beginning, but I failed then to realize back then that it should have been
reported and later disclosed as a CVE, so better late than never. It resurfaced in a discussion with a friend.<br>
<br>
I have looked at the homepage, GitHub repo and issues, bugzilla and could not find the issue in there. Also I didn't find how to securely and privately disclose security issues to the team. I would be happy to submit it through the security advisories function
on GitHub for discussion if you could enable the function, or provide a different option to share the finding?</div>
<div style="margin: 0px; font-size: 12pt; font-family: Calibri, Arial, Helvetica, sans-serif; color: black; background-color: rgb(255, 255, 255)">
<br>
</div>
<div style="margin: 0px; font-size: 12pt; font-family: Calibri, Arial, Helvetica, sans-serif; color: black; background-color: rgb(255, 255, 255)">
I am in the process of doing a write-up of the issue to submit to you.</div>
<div style="margin: 0px; font-size: 12pt; font-family: Calibri, Arial, Helvetica, sans-serif; color: black; background-color: rgb(255, 255, 255)">
<br>
</div>
<div style="margin: 0px; font-size: 12pt; font-family: Calibri, Arial, Helvetica, sans-serif; color: black; background-color: rgb(255, 255, 255)">
Best regards</div>
<div style="margin: 0px; font-size: 12pt; font-family: Calibri, Arial, Helvetica, sans-serif; color: black; background-color: rgb(255, 255, 255)">
Philippe</div>
<br>
</div>
</body>
</html>