GHSA-37xq-q42p-rv3p
ntpd has Dependency on Vulnerable Third-Party Component
GHSA-37xq-q42p-rv3p is a low vulnerability (CVSS 2.6) in ntpd, published August 24, 2023. No source lists public exploit code. Fixed in ntpd 0.3.7.
- Severity
- 2.6 LowCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.3.7ntpd
Description
During startup, an attacker that can man-in-the-middle traffic to and from NTS key exchange servers can trigger a very expensive key validation process due to a vulnerability in webpki.
Impact
This vulnerability can lead to excessive cpu usage on startup on clients configured to use NTS
Patches
Affected users are recommended to upgrade to version 0.3.7
References
See also https://github.com/rustsec/advisory-db/blob/main/crates/rustls-webpki/RUSTSEC-2023-0053.md
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ntpdcrates.io | before 0.3.7 | 0.3.7 |
What each source reports
GitHub Advisories Score used
ntpd has Dependency on Vulnerable Third-Party Component
During startup, an attacker that can man-in-the-middle traffic to and from NTS key exchange servers can trigger a very expensive key validation process due to a vulnerability in webpki.
Impact
This vulnerability can lead to excessive cpu usage on startup on clients configured to use NTS
Patches
Affected users are recommended to upgrade to version 0.3.7
References
See also https://github.com/rustsec/advisory-db/blob/main/crates/rustls-webpki/RUSTSEC-2023-0053.md
- Record
GHSA-37xq-q42p-rv3p- CVSS 3.1
- 2.6 Low
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-1395
- Updated
- 2026-11-02
OSV
ntpd has Dependency on Vulnerable Third-Party Component
During startup, an attacker that can man-in-the-middle traffic to and from NTS key exchange servers can trigger a very expensive key validation process due to a vulnerability in webpki.
Impact
This vulnerability can lead to excessive cpu usage on startup on clients configured to use NTS
Patches
Affected users are recommended to upgrade to version 0.3.7
References
See also https://github.com/rustsec/advisory-db/blob/main/crates/rustls-webpki/RUSTSEC-2023-0053.md
- Record
GHSA-37xq-q42p-rv3p- CVSS 3.1
- 2.6 Low
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-1395
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-37xq-q42p-rv3p