GHSA-p4c5-8c68-5fjq
CVE Information
A peer-controlled name containing a newline/CR was written verbatim into the name-converter helper's persistent line protocol, allowing request injection into that channel.
Fix: reject converter tokens containing control characters.
Test: daemon-namecvt-newline-token.
Credit: Mitchell Benjamin (Revamp Studio).
Affected: rsync 3.4.3 and earlier; fixed in 3.5.0. (Precise introduced-in ranges being finalised.)