GHSA-h2q9-5fr8-w635
CVE Information
With
proxy protocol = true, a client connecting directly (not via the trusted proxy) could send a PROXY header to forge its source address and bypass host-based access control (hosts allow/deny).Fix: require the direct peer to match a configured trusted-proxy list before honouring a forwarded address.
Test: proxy-protocol-trusted-peer.
Affected: rsync 3.4.3 and earlier; fixed in 3.5.0. (Precise introduced-in ranges being finalised.)