We’d like to raise awareness about the rsync security release version 3.4.0-1 as described in our advisory ASA-202501-1.
An attacker only requires anonymous read access to a vulnerable rsync server, such as a public mirror, to execute arbitrary code on the machine the server is running on. Additionally, attackers can take control of an affected server and read/write arbitrary files of any connected client. Sensitive data can be extracted, such as OpenPGP and SSH keys, and malicious code can be executed by overwriting files such as ~/.bashrc or ~/.popt.
We highly advise anyone who runs an rsync daemon or client prior to version 3.4.0-1 to upgrade and reboot their systems immediately. As Arch Linux mirrors are mostly synchronized using rsync, we highly advise any mirror administrator to act immediately, even though the hosted package files themselves are cryptographically signed.
All infrastructure servers and mirrors maintained by Arch Linux have already been updated.
AUR (Arch User Repository) packages are neither supported by Arch nor Manjaro. Posts about them in Announcements topics are off-topic and will be flagged, moved or removed without warning.
For help with AUR packages, please create a new topic in AUR and a helpful volunteer may be able to assist you.
I switched from stable to unstable (sudo pacman-mirrors --api --set-branch unstable and sudo pacman-mirrors --fasttrack 5 && sudo pacman -Syu) and got this message:
/usr/lib/sysusers.d/nvidia-utils.conf:1: Unknown modifiers in command '!u'.
But there are still an untold number of threads and users with the suggestion in one way or another to disable the signatures.
Such as here:
I just meant that anyone who has followed such advice or for whatever reason has lesser SigLevel options applied would be vulnerable to an exploited mirror.
For a while at least one of the most common responses to ‘Trouble syncing packages, errors about keys’ on the forums was to augment the SigLevel options to something more permissive. That always meant lesser security, but this news makes a tangible argument for why not to.
AUR (Arch User Repository) packages are neither supported by Arch nor Manjaro. Posts about them in Announcements topics are off-topic and will be flagged, moved or removed without warning.
