{"id":"CVE-2014-0021","aliases":["AZL-110379","DEBIAN-CVE-2014-0021","EUVD-2014-0122","GHSA-4xjv-r88q-f87j","MGASA-2014-0052","UBUNTU-CVE-2014-0021","openSUSE-SU-2024:10345-1"],"status":"published","title":"Chrony before 1.29.1 has traffic amplification in cmdmon protocol","description":"Chrony before 1.29.1 has traffic amplification in cmdmon protocol","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.04167,"percentile":0.90974,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2014-02-11T22:13:17Z","modified":"2026-10-27T05:36:16Z","fixes":[{"ecosystem":"Debian:12","package":"chrony","fixed_in":["1.29.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"chrony","fixed_in":["1.29.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"chrony","fixed_in":["1.29.1-1"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"chrony","fixed_in":["1.29.1-1.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"chrony","fixed_in":["1.29-1ubuntu0.1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"chrony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.5-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"chrony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"chrony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"chrony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.1-1"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"chrony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.1-1.mga4"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"chrony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-1ubuntu0.1+esm1"}]}],"versions":["1.26-4","1.29-1","1.29-1ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"chrony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-1.1"}]}],"bundled":4}],"products":[{"vendor":"chrony","product":"chrony"},{"vendor":"chrony_project","product":"chrony"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://security-tracker.debian.org/tracker/CVE-2014-0021","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0021","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2014/01/18/2","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127837.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128753.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2014/01/17/9","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2014/01/18/1","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2014/01/18/3","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2014/01/19/1","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.securityfocus.com/bid/65035","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/90925","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0021","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4xjv-r88q-f87j"},{"url":"https://advisories.mageia.org/MGASA-2014-0052.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12347","tags":["report"]},{"url":"http://chrony.tuxfamily.org/News.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-0021","tags":["report"]},{"url":"http://listengine.tuxfamily.org/chrony.tuxfamily.org/chrony-dev/2014/01/msg00005.html","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0021","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1567","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-0021","description":"Chrony before 1.29.1 has traffic amplification in cmdmon protocol","status":"published","published":"2019-11-15T14:35:31Z","modified":"2024-08-06T08:58:26.538Z","updated_at":"2026-11-02T14:33:47.330011Z"}],"euvd":[{"id":"EUVD-2014-0122","description":"Chrony before 1.29.1 has traffic amplification in cmdmon protocol","status":"published","published":"2019-11-15T14:35:31Z","modified":"2024-08-06T08:58:26Z","updated_at":"2026-11-03T01:57:23.42372Z"}],"ghsa":[{"id":"GHSA-4xjv-r88q-f87j","title":"Chrony before 1.29.1 has traffic amplification in cmdmon protocol","description":"Chrony before 1.29.1 has traffic amplification in cmdmon protocol","status":"published","published":"2022-05-17T19:57:03Z","modified":"2024-04-03T23:59:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T14:55:48.388362Z"}],"nvd":[{"id":"CVE-2014-0021","description":"Chrony before 1.29.1 has traffic amplification in cmdmon protocol","status":"published","published":"2019-11-15T15:15:11.763Z","modified":"2026-06-17T00:02:06.323Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:59.461996Z"}],"osv":[{"id":"AZL-110379","title":"CVE-2014-0021 affecting package chrony 4.5-1","description":"Chrony before 1.29.1 has traffic amplification in cmdmon protocol","status":"published","published":"2019-11-15T15:15:11Z","modified":"2026-10-27T05:36:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:02.368326Z"},{"id":"CVE-2014-0021","description":"Chrony before 1.29.1 has traffic amplification in cmdmon protocol","status":"published","published":"2019-11-15T15:15:11Z","modified":"2026-04-16T06:21:01.158627684Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-0021","description":"Chrony before 1.29.1 has traffic amplification in cmdmon protocol","status":"published","published":"2019-11-15T15:15:11.763Z","modified":"2026-10-23T16:00:08.868632003Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"UBUNTU-CVE-2014-0021","description":"Chrony before 1.29.1 has traffic amplification in cmdmon protocol","status":"published","published":"2019-11-15T15:15:00Z","modified":"2025-09-08T16:43:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:07.855521Z"},{"id":"MGASA-2014-0052","title":"Updated chrony package fixes security vulnerability","description":"Updated chrony package fixes security vulnerability:\n\nIn the chrony control protocol some replies are significantly larger than\ntheir requests, which allows an attacker to use it in an amplification\nattack (CVE-2014-0021).\n\nNote: in the default configuration, cmdallow is restricted to localhost,\nso significant amplification is only possible if the configuration has\nbeen changed to allow cmdallow from other hosts. Even from hosts whose\naccess is denied, minor amplification is still possible.\n","status":"published","published":"2014-02-11T22:13:17Z","modified":"2026-04-16T06:24:17.507429712Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10345-1","title":"chrony-2.4.1-1.1 on GA media","description":"These are all security issues fixed in the chrony-2.4.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:02:32.739537Z","updated_at":"2026-11-02T16:58:34.487567Z"}]}}