Skip to content
OpenAdvisories
Medium ELSA-2020-2663 2 CVEs

Moderate: ntp security update (Oracle Linux 7)

Published Jun 24, 2020 · Updated Jun 24, 2020

Ecosystem: Oracle Linux

Summary

[4.2.6p5-29.0.1]
- Bump release to avoid ULN conflict with Oracle modified errata.

[4.2.6p5-29.el7_8.2]
- don't update transmission time on invalid response (CVE-2020-11868)
- randomize transmit timestamp in client requests (CVE-?, #1813787)

Fixed packages 5

ReleasePackageFixed in
Oracle Linux · 7 ntp 0:4.2.6p5-29.0.1.el7_8.2
Oracle Linux · 7 ntp-doc 0:4.2.6p5-29.0.1.el7_8.2
Oracle Linux · 7 ntp-perl 0:4.2.6p5-29.0.1.el7_8.2
Oracle Linux · 7 ntpdate 0:4.2.6p5-29.0.1.el7_8.2
Oracle Linux · 7 sntp 0:4.2.6p5-29.0.1.el7_8.2

Vulnerabilities 2

  • Medium 5.9
    CVE-2020-11868

    ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronizati…

    ntp ntp Debian Ubuntu
  • Medium 5.9
    CVE-2020-13817

    ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit …

    ntp ntp Debian Ubuntu