CVE-2020-14387: 
NixOS vulnerability analysis and mitigation

A flaw was found in rsync versions since 3.2.0pre1 and before 3.2.4. The vulnerability (CVE-2020-14387) involves rsync improperly validating certificates with host mismatch in rsync-ssl. This security issue was discovered and reported by Matt McCutchen (RedHat Bugzilla).

The vulnerability stems from rsync-ssl not verifying the hostname in the server certificate when using openssl mode. The issue has a CVSS v3.1 Base Score of 7.4 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (NVD).

The vulnerability could compromise the confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity, while there is no impact on system availability (Debian Tracker).

A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname. The attack complexity is considered high, requiring no privileges or user interaction (NVD).

The vulnerability can be mitigated by not using rsync-ssl in openssl mode. The issue was fixed in rsync version 3.2.4. Users should upgrade to this version or later to address the vulnerability (RedHat Bugzilla).