{"id":"CVE-2020-13817","aliases":["CLSA-2024-1735122554","CLSA-2024-1735128099","DEBIAN-CVE-2020-13817","EUVD-2020-6032","GHSA-fx6x-7xgx-2wwp","RHSA-2020:2663","SUSE-SU-2020:14415-1","SUSE-SU-2020:1805-1","SUSE-SU-2020:1823-1","UBUNTU-CVE-2020-13817","openSUSE-SU-2020:0934-1","openSUSE-SU-2020:1007-1","openSUSE-SU-2024:11102-1"],"status":"published","title":"ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of...","description":"ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AC:H/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.03362,"percentile":0.88896,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-330"],"published":"2020-06-04T12:31:55Z","modified":"2026-08-27T13:03:04Z","fixes":[{"ecosystem":"TuxCare:CentOS:6","package":"ntp","fixed_in":["4.2.6p5-16.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"ntp-doc","fixed_in":["4.2.6p5-16.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"ntp-perl","fixed_in":["4.2.6p5-16.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"ntpdate","fixed_in":["4.2.6p5-16.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"ntp","fixed_in":["4.2.6p5-16.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"ntp-doc","fixed_in":["4.2.6p5-16.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"ntp-perl","fixed_in":["4.2.6p5-16.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"ntpdate","fixed_in":["4.2.6p5-16.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"ntp","fixed_in":["1:4.2.8p14+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-16.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-16.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-16.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-16.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-16.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-16.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-16.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-16.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.8p14+dfsg-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-29.el7_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-29.el7_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-29.el7_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-29.el7_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-29.el7_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"sntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-29.el7_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-29.el7_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-29.el7_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-29.el7_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-29.el7_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-29.el7_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"sntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-29.el7_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-29.el7_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-29.el7_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-29.el7_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-29.el7_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-29.el7_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"sntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-29.el7_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-29.el7_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-29.el7_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-29.el7_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-29.el7_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-29.el7_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"sntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-29.el7_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-64.16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-4.10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP2","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-4.10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-4.10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-4.10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.1","1:4.2.6.p5+dfsg-3ubuntu2.14.04.2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.3","1:4.2.6.p5+dfsg-3ubuntu2.14.04.5","1:4.2.6.p5+dfsg-3ubuntu2.14.04.6","1:4.2.6.p5+dfsg-3ubuntu2.14.04.7","1:4.2.6.p5+dfsg-3ubuntu2.14.04.8","1:4.2.6.p5+dfsg-3ubuntu2.14.04.10","1:4.2.6.p5+dfsg-3ubuntu2.14.04.11","1:4.2.6.p5+dfsg-3ubuntu2.14.04.12","1:4.2.6.p5+dfsg-3ubuntu2.14.04.13","1:4.2.6.p5+dfsg-3ubuntu2.14.04.13+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu8","1:4.2.6.p5+dfsg-3ubuntu8.1","1:4.2.6.p5+dfsg-3ubuntu9","1:4.2.8p4+dfsg-3ubuntu1","1:4.2.8p4+dfsg-3ubuntu2","1:4.2.8p4+dfsg-3ubuntu3","1:4.2.8p4+dfsg-3ubuntu4","1:4.2.8p4+dfsg-3ubuntu5","1:4.2.8p4+dfsg-3ubuntu5.1","1:4.2.8p4+dfsg-3ubuntu5.2","1:4.2.8p4+dfsg-3ubuntu5.3","1:4.2.8p4+dfsg-3ubuntu5.4","1:4.2.8p4+dfsg-3ubuntu5.5","1:4.2.8p4+dfsg-3ubuntu5.6","1:4.2.8p4+dfsg-3ubuntu5.7","1:4.2.8p4+dfsg-3ubuntu5.8","1:4.2.8p4+dfsg-3ubuntu5.9","1:4.2.8p4+dfsg-3ubuntu5.10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.2.8p10+dfsg-5ubuntu3","1:4.2.8p10+dfsg-5ubuntu4","1:4.2.8p10+dfsg-5ubuntu5","1:4.2.8p10+dfsg-5ubuntu6","1:4.2.8p10+dfsg-5ubuntu7","1:4.2.8p10+dfsg-5ubuntu7.1","1:4.2.8p10+dfsg-5ubuntu7.1+esm1","1:4.2.8p10+dfsg-5ubuntu7.1+esm2","1:4.2.8p10+dfsg-5ubuntu7.2","1:4.2.8p10+dfsg-5ubuntu7.2+esm1","1:4.2.8p10+dfsg-5ubuntu7.3","1:4.2.8p10+dfsg-5ubuntu7.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.2.8p12+dfsg-3ubuntu2","1:4.2.8p12+dfsg-3ubuntu3","1:4.2.8p12+dfsg-3ubuntu4","1:4.2.8p12+dfsg-3ubuntu4.20.04.1","1:4.2.8p12+dfsg-3ubuntu4.20.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.2.8p12+dfsg-3ubuntu6","1:4.2.8p15+dfsg-1ubuntu1","1:4.2.8p15+dfsg-1ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-lp151.2.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-lp152.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-7.2"}]}],"bundled":18}],"products":[{"vendor":"fujitsu","product":"m10-1_firmware"},{"vendor":"fujitsu","product":"m10-4_firmware"},{"vendor":"fujitsu","product":"m10-4s_firmware"},{"vendor":"fujitsu","product":"m12-1_firmware"},{"vendor":"fujitsu","product":"m12-2_firmware"},{"vendor":"fujitsu","product":"m12-2s_firmware"},{"vendor":"netapp","product":"cloud_backup"},{"vendor":"netapp","product":"clustered_data_ontap"},{"vendor":"netapp","product":"data_ontap"},{"vendor":"netapp","product":"element_software"},{"vendor":"netapp","product":"h300e_firmware"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410c_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h500e_firmware"},{"vendor":"netapp","product":"h500s_firmware"},{"vendor":"netapp","product":"h700e_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"netapp","product":"hci_compute_node_firmware"},{"vendor":"netapp","product":"hci_management_node"},{"vendor":"netapp","product":"ontap_tools"},{"vendor":"netapp","product":"solidfire"},{"vendor":"netapp","product":"steelstore_cloud_integrated_storage"},{"vendor":"ntp","product":"ntp"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202007-12","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://support.ntp.org/bin/view/Main/NtpBug3596","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","article"]},{"url":"https://bugs.ntp.org/show_bug.cgi?id=3596","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://security.netapp.com/advisory/ntap-20200625-0004/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13817","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20200625-0004"},{"url":"https://github.com/advisories/GHSA-fx6x-7xgx-2wwp"},{"url":"https://errata.cloudlinux.com/els6/CLSA-2024-1735122554.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2024-1735128099.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-13817","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2663","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1716665","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1811627","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2663.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-11868","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11868","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11868","tags":["advisory"]},{"url":"http://support.ntp.org/bin/view/Main/NtpBug3592","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-13817","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13817","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-202014415-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1169740","tags":["report"]},{"url":"https://bugzilla.suse.com/1171355","tags":["report"]},{"url":"https://bugzilla.suse.com/1172651","tags":["report"]},{"url":"https://bugzilla.suse.com/1173334","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15025","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201805-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201823-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1125401","tags":["report"]},{"url":"https://bugzilla.suse.com/992038","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-13817","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BIQMBPSMZGTUEK5KJC4HX6YOA3YJ3SL6/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JNRU5O2D5HWSXEDH4T2XTCSGOTFSCOIH/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8936","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-13817","description":"ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.","status":"published","published":"2020-06-04T12:31:55Z","modified":"2025-05-05T17:07:58.872Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AC:H/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N","level":"medium","assessor":"cna"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T14:35:54.170199Z"}],"euvd":[{"id":"EUVD-2020-6032","description":"ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.","status":"published","published":"2020-06-04T12:31:55Z","modified":"2025-05-05T17:07:58Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:55.636374Z"}],"ghsa":[{"id":"GHSA-fx6x-7xgx-2wwp","title":"ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of...","description":"ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.","status":"published","published":"2022-05-24T17:19:20Z","modified":"2025-05-05T18:31:49Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-20","CWE-330"],"updated_at":"2026-11-02T15:02:07.480076Z"}],"nvd":[{"id":"CVE-2020-13817","description":"ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.","status":"published","published":"2020-06-04T13:15:11.053Z","modified":"2026-06-17T02:53:42.76Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T14:06:05.962132Z"}],"osv":[{"id":"CVE-2020-13817","description":"ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.","status":"published","published":"2020-06-04T13:15:11.053Z","modified":"2026-03-15T22:32:32.850658Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"DEBIAN-CVE-2020-13817","description":"ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.","status":"published","published":"2020-06-04T13:15:11.053Z","modified":"2026-08-27T13:03:04.317466905Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"RHSA-2020:2663","title":"Red Hat Security Advisory: ntp security update","status":"published","published":"2024-09-16T04:24:04Z","modified":"2026-06-26T12:22:14.910751175Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"UBUNTU-CVE-2020-13817","description":"ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.","status":"published","published":"2020-06-04T13:15:00Z","modified":"2025-10-24T04:48:31Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"CLSA-2024-1735122554","title":"ntp: Fix of CVE-2020-13817","description":"- CVE-2020-13817: randomize transmit timestamp in client requests","status":"published","published":"2024-12-25T10:29:53Z","modified":"2026-06-01T00:33:16.243950014Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2024-1735128099","title":"ntp: Fix of CVE-2020-13817","description":"- CVE-2020-13817: randomize transmit timestamp in client requests","status":"published","published":"2024-12-25T12:01:44Z","modified":"2026-06-01T00:33:25.88323919Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"openSUSE-SU-2020:0934-1","title":"Security update for ntp","description":"This update for ntp fixes the following issues:\n\nntp was updated to 4.2.8p15\n\n- CVE-2020-11868: Fixed an issue which a server mode packet with spoofed source address \n  frequently send to the client ntpd could have caused denial of service (bsc#1169740).\n- CVE-2018-8956: Fixed an issue which could have allowed remote attackers to prevent \n  a broadcast client from synchronizing its clock with a broadcast NTP server via spoofed \n  mode 3 and mode 5 packets (bsc#1171355).\n- CVE-2020-13817: Fixed an issue which an off-path attacker with the ability to query time \n  from victim's ntpd instance could have modified the victim's clock by a limited amount (bsc#1172651).\n- CVE-2020-15025: Fixed an issue which remote attacker could have caused denial of service by consuming \n  the memory when a CMAC key was used andassociated with a CMAC algorithm in the ntp.keys (bsc#1173334).\n- Removed an OpenSSL version warning (bsc#992038 and bsc#1125401).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-07-06T14:39:34Z","modified":"2026-02-04T04:14:11.404331Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:1007-1","title":"Security update for ntp","description":"This update for ntp fixes the following issues:\n\nntp was updated to 4.2.8p15\n\n- CVE-2020-11868: Fixed an issue which a server mode packet with spoofed source address \n  frequently send to the client ntpd could have caused denial of service (bsc#1169740).\n- CVE-2018-8956: Fixed an issue which could have allowed remote attackers to prevent \n  a broadcast client from synchronizing its clock with a broadcast NTP server via spoofed \n  mode 3 and mode 5 packets (bsc#1171355).\n- CVE-2020-13817: Fixed an issue which an off-path attacker with the ability to query time \n  from victim's ntpd instance could have modified the victim's clock by a limited amount (bsc#1172651).\n- CVE-2020-15025: Fixed an issue which remote attacker could have caused denial of service by consuming \n  the memory when a CMAC key was used andassociated with a CMAC algorithm in the ntp.keys (bsc#1173334).\n- Removed an OpenSSL version warning (bsc#992038 and bsc#1125401).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-07-19T08:27:16Z","modified":"2026-02-04T02:41:02.11813Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11102-1","title":"ntp-4.2.8p15-7.2 on GA media","description":"These are all security issues fixed in the ntp-4.2.8p15-7.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:08:15.257534Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2020:14415-1","title":"Security update for ntp","description":"This update for ntp fixes the following issues:\n\nntp was updated to 4.2.8p15\n\n- CVE-2020-11868: Fixed an issue which a server mode packet with spoofed source address \n  frequently send to the client ntpd could have caused denial of service (bsc#1169740).\n- CVE-2018-8956: Fixed an issue which could have allowed remote attackers to prevent \n  a broadcast client from synchronizing its clock with a broadcast NTP server via spoofed \n  mode 3 and mode 5 packets (bsc#1171355).\n- CVE-2020-13817: Fixed an issue which an off-path attacker with the ability to query time \n  from victim's ntpd instance could have modified the victim's clock by a limited amount (bsc#1172651).\n- CVE-2020-15025: Fixed an issue which remote attacker could have caused denial of service by consuming \n  the memory when a CMAC key was used andassociated with a CMAC algorithm in the ntp.keys (bsc#1173334).\n","status":"published","published":"2020-07-01T14:18:41Z","modified":"2026-02-04T02:22:56.615519Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1805-1","title":"Security update for ntp","description":"This update for ntp fixes the following issues:\n\nntp was updated to 4.2.8p15\n\n- CVE-2020-11868: Fixed an issue which a server mode packet with spoofed source address \n  frequently send to the client ntpd could have caused denial of service (bsc#1169740).\n- CVE-2018-8956: Fixed an issue which could have allowed remote attackers to prevent \n  a broadcast client from synchronizing its clock with a broadcast NTP server via spoofed \n  mode 3 and mode 5 packets (bsc#1171355).\n- CVE-2020-13817: Fixed an issue which an off-path attacker with the ability to query time \n  from victim's ntpd instance could have modified the victim's clock by a limited amount (bsc#1172651).\n- CVE-2020-15025: Fixed an issue which remote attacker could have caused denial of service by consuming \n  the memory when a CMAC key was used andassociated with a CMAC algorithm in the ntp.keys (bsc#1173334).\t  \n","status":"published","published":"2020-06-30T15:37:45Z","modified":"2026-02-04T03:20:09.077271Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1823-1","title":"Security update for ntp","description":"This update for ntp fixes the following issues:\n\nntp was updated to 4.2.8p15\n\n- CVE-2020-11868: Fixed an issue which a server mode packet with spoofed source address \n  frequently send to the client ntpd could have caused denial of service (bsc#1169740).\n- CVE-2018-8956: Fixed an issue which could have allowed remote attackers to prevent \n  a broadcast client from synchronizing its clock with a broadcast NTP server via spoofed \n  mode 3 and mode 5 packets (bsc#1171355).\n- CVE-2020-13817: Fixed an issue which an off-path attacker with the ability to query time \n  from victim's ntpd instance could have modified the victim's clock by a limited amount (bsc#1172651).\n- CVE-2020-15025: Fixed an issue which remote attacker could have caused denial of service by consuming \n  the memory when a CMAC key was used andassociated with a CMAC algorithm in the ntp.keys (bsc#1173334).\n- Removed an OpenSSL version warning (bsc#992038 and bsc#1125401).\n","status":"published","published":"2020-07-02T09:32:43Z","modified":"2026-02-04T02:53:04.936713Z","updated_at":"2026-11-02T15:53:47.634847Z"}]}}