Description
Chrony before 1.29.1 has traffic amplification in cmdmon protocol
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Chrony | Chrony | Fixed in 1.29.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | chrony | 1.29.1-1 | — |
| Debian 13 | chrony | 1.29.1-1 | — |
| Debian 12 | chrony | 1.29.1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | chrony | 1.29-1ubuntu0.1+esm1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | chrony | 2.4.1-1.1 | openSUSE-SU-2024:10345-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | chrony | No fix yet | — |
Advisories 1
- openSUSE-SU-2024:10345-1 chrony-2.4.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://security-tracker.debian.org/tracker/CVE-2014-0021
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0021
- http://www.openwall.com/lists/oss-security/2014/01/18/2
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127837.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128753.html
- http://www.openwall.com/lists/oss-security/2014/01/17/9
- http://www.openwall.com/lists/oss-security/2014/01/18/1
- http://www.openwall.com/lists/oss-security/2014/01/18/3
- http://www.openwall.com/lists/oss-security/2014/01/19/1
- http://www.securityfocus.com/bid/65035
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90925