CVE-2020-14387: samba rsync

csirt@kutim:~/threat-intel/cve/CVE-2020-14387

CVSS 7.4 · High EPSS 1,1%

Kerentanan Improper Validation of Certificate with Host Mismatch pada samba rsync. Skor CVSS 3.1 7.4 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.

Rincian

Terbit di NVD: 27 Mei 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.4 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-297: Improper Validation of Certificate with Host Mismatch
EPSS (30 hari): 1,1% peluang dieksploitasi; lebih tinggi dari 64,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
samba	rsync	Versi 3.2.1 hingga sebelum 3.2.4
samba	rsync	Versi 3.2.0
samba	rsync	Versi 3.2.0 pre1
samba	rsync	Versi 3.2.0 pre2
samba	rsync	Versi 3.2.0 pre3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://bugzilla.redhat.com/show_bug.cgi?id=1875549 issue tracking · patch · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.