{"id":"CVE-2020-15025","aliases":["DEBIAN-CVE-2020-15025","EUVD-2020-7153","GHSA-p62f-hvr2-5w5f","MGASA-2020-0281","OESA-2022-1952","OESA-2022-1953","SUSE-SU-2020:14415-1","SUSE-SU-2020:1805-1","SUSE-SU-2020:1823-1","UBUNTU-CVE-2020-15025","USN-5175-1","openSUSE-SU-2020:0934-1","openSUSE-SU-2020:1007-1","openSUSE-SU-2024:11102-1"],"status":"published","title":"ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a...","description":"ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AC:H/AV:N/A:H/C:N/I:N/PR:H/S:U/UI:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.03138,"percentile":0.88064,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-401"],"published":"2020-06-24T18:04:39Z","modified":"2026-08-27T13:03:06Z","fixes":[{"ecosystem":"Debian:11","package":"ntp","fixed_in":["1:4.2.8p15-1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"ntp","fixed_in":["4.2.8p15-1.mga7"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"ntp","fixed_in":["4.2.8p14-5.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"ntp","fixed_in":["4.2.8p14-6.oe1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ntp","fixed_in":["1:4.2.8p12+dfsg-3ubuntu4.20.04.1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.8p15-1"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-1.mga7"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p14-5.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p14-6.oe1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-64.16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-88.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-4.10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP2","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-4.10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-4.10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-4.10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.8p12+dfsg-3ubuntu4.20.04.1+esm1"}]}],"versions":["1:4.2.8p12+dfsg-3ubuntu2","1:4.2.8p12+dfsg-3ubuntu3","1:4.2.8p12+dfsg-3ubuntu4","1:4.2.8p12+dfsg-3ubuntu4.20.04.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-lp151.2.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-lp152.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-7.2"}]}],"bundled":18}],"products":[{"vendor":"netapp","product":"8300_firmware"},{"vendor":"netapp","product":"8700_firmware"},{"vendor":"netapp","product":"a400_firmware"},{"vendor":"netapp","product":"cloud_backup"},{"vendor":"netapp","product":"h300e_firmware"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410c_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h500e_firmware"},{"vendor":"netapp","product":"h500s_firmware"},{"vendor":"netapp","product":"h700e_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"netapp","product":"steelstore_cloud_integrated_storage"},{"vendor":"ntp","product":"ntp"},{"vendor":"opensuse","product":"leap"},{"vendor":"oracle","product":"zfs_storage_appliance_kit"}],"references":[{"url":"https://support.ntp.org/bin/view/Main/SecurityNotice#June_2020_ntp_4_2_8p15_NTP_Relea","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory","report"]},{"url":"https://support.ntp.org/bin/view/Main/NtpBug3661","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://bugs.gentoo.org/729458","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202007-12","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20200702-0002/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15025","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p62f-hvr2-5w5f"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-15025","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0281.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26851","tags":["report"]},{"url":"http://support.ntp.org/bin/view/Main/SecurityNotice#June_2020_ntp_4_2_8p15_NTP_Relea","tags":["web"]},{"url":"http://support.ntp.org/bin/view/Main/NtpBug3661","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1952","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1953","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-202014415-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1169740","tags":["report"]},{"url":"https://bugzilla.suse.com/1171355","tags":["report"]},{"url":"https://bugzilla.suse.com/1172651","tags":["report"]},{"url":"https://bugzilla.suse.com/1173334","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15025","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201805-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201823-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1125401","tags":["report"]},{"url":"https://bugzilla.suse.com/992038","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-15025","tags":["report"]},{"url":"https://bugs.ntp.org/show_bug.cgi?id=3661","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5175-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15025","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BIQMBPSMZGTUEK5KJC4HX6YOA3YJ3SL6/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JNRU5O2D5HWSXEDH4T2XTCSGOTFSCOIH/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8936","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-15025","description":"ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.","status":"published","published":"2020-06-24T18:04:39Z","modified":"2024-08-04T13:00:52.098Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AC:H/AV:N/A:H/C:N/I:N/PR:H/S:U/UI:N","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:35:50.228781Z"}],"euvd":[{"id":"EUVD-2020-7153","description":"ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.","status":"published","published":"2020-06-24T18:04:39Z","modified":"2024-08-04T13:00:52Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AC:H/AV:N/A:H/C:N/I:N/PR:H/S:U/UI:N","level":"medium"}],"updated_at":"2026-11-03T03:07:33.617168Z"}],"ghsa":[{"id":"GHSA-p62f-hvr2-5w5f","title":"ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a...","description":"ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.","status":"published","published":"2022-05-24T17:21:37Z","modified":"2023-01-31T05:02:19Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:48:13.960905Z"}],"nvd":[{"id":"CVE-2020-15025","description":"ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.","status":"published","published":"2020-06-24T19:15:10.147Z","modified":"2026-06-17T02:55:55.68Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:06:08.145904Z"}],"osv":[{"id":"CVE-2020-15025","description":"ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.","status":"published","published":"2020-06-24T19:15:10.147Z","modified":"2026-04-16T04:33:56.61964593Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"DEBIAN-CVE-2020-15025","description":"ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.","status":"published","published":"2020-06-24T19:15:10.147Z","modified":"2026-08-27T13:03:06.102785911Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"OESA-2022-1952","title":"ntp security update","description":"NTP is a protocol designed to synchronize the clocks of computers over a network, NTP version 4, a significant revision of the previous NTP standard, is the current development version. It is formalized by RFCs released by the IETF.\r\n\r\nSecurity Fix(es):\r\n\r\nntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.(CVE-2020-15025)","status":"published","published":"2022-09-23T11:05:15Z","modified":"2026-08-18T01:17:18.582981208Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"OESA-2022-1953","title":"ntp security update","description":"NTP is a protocol designed to synchronize the clocks of computers over a network, NTP version 4, a significant revision of the previous NTP standard, is the current development version. It is formalized by RFCs released by the IETF.\r\n\r\nSecurity Fix(es):\r\n\r\nntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.(CVE-2020-15025)","status":"published","published":"2022-09-23T11:05:15Z","modified":"2026-08-18T01:17:18.547338757Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2020-15025","description":"ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.","status":"withdrawn","published":"2020-06-24T19:15:00Z","modified":"2026-02-04T02:18:17.095742Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"MGASA-2020-0281","title":"Updated ntp packages fix security vulnerability","description":"Updated ntp packages fix security vulnerability:\n\nntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote\nattackers to cause a denial of service (memory consumption) by sending\npackets, because memory is not freed in situations where a CMAC key is\nused and associated with a CMAC algorithm in the ntp.keys file\n(CVE-2020-15025)\n","status":"published","published":"2020-07-05T19:48:23Z","modified":"2026-04-16T04:41:35.359516574Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:0934-1","title":"Security update for ntp","description":"This update for ntp fixes the following issues:\n\nntp was updated to 4.2.8p15\n\n- CVE-2020-11868: Fixed an issue which a server mode packet with spoofed source address \n  frequently send to the client ntpd could have caused denial of service (bsc#1169740).\n- CVE-2018-8956: Fixed an issue which could have allowed remote attackers to prevent \n  a broadcast client from synchronizing its clock with a broadcast NTP server via spoofed \n  mode 3 and mode 5 packets (bsc#1171355).\n- CVE-2020-13817: Fixed an issue which an off-path attacker with the ability to query time \n  from victim's ntpd instance could have modified the victim's clock by a limited amount (bsc#1172651).\n- CVE-2020-15025: Fixed an issue which remote attacker could have caused denial of service by consuming \n  the memory when a CMAC key was used andassociated with a CMAC algorithm in the ntp.keys (bsc#1173334).\n- Removed an OpenSSL version warning (bsc#992038 and bsc#1125401).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-07-06T14:39:34Z","modified":"2026-02-04T04:14:11.404331Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:1007-1","title":"Security update for ntp","description":"This update for ntp fixes the following issues:\n\nntp was updated to 4.2.8p15\n\n- CVE-2020-11868: Fixed an issue which a server mode packet with spoofed source address \n  frequently send to the client ntpd could have caused denial of service (bsc#1169740).\n- CVE-2018-8956: Fixed an issue which could have allowed remote attackers to prevent \n  a broadcast client from synchronizing its clock with a broadcast NTP server via spoofed \n  mode 3 and mode 5 packets (bsc#1171355).\n- CVE-2020-13817: Fixed an issue which an off-path attacker with the ability to query time \n  from victim's ntpd instance could have modified the victim's clock by a limited amount (bsc#1172651).\n- CVE-2020-15025: Fixed an issue which remote attacker could have caused denial of service by consuming \n  the memory when a CMAC key was used andassociated with a CMAC algorithm in the ntp.keys (bsc#1173334).\n- Removed an OpenSSL version warning (bsc#992038 and bsc#1125401).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-07-19T08:27:16Z","modified":"2026-02-04T02:41:02.11813Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11102-1","title":"ntp-4.2.8p15-7.2 on GA media","description":"These are all security issues fixed in the ntp-4.2.8p15-7.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:08:15.257534Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2020:14415-1","title":"Security update for ntp","description":"This update for ntp fixes the following issues:\n\nntp was updated to 4.2.8p15\n\n- CVE-2020-11868: Fixed an issue which a server mode packet with spoofed source address \n  frequently send to the client ntpd could have caused denial of service (bsc#1169740).\n- CVE-2018-8956: Fixed an issue which could have allowed remote attackers to prevent \n  a broadcast client from synchronizing its clock with a broadcast NTP server via spoofed \n  mode 3 and mode 5 packets (bsc#1171355).\n- CVE-2020-13817: Fixed an issue which an off-path attacker with the ability to query time \n  from victim's ntpd instance could have modified the victim's clock by a limited amount (bsc#1172651).\n- CVE-2020-15025: Fixed an issue which remote attacker could have caused denial of service by consuming \n  the memory when a CMAC key was used andassociated with a CMAC algorithm in the ntp.keys (bsc#1173334).\n","status":"published","published":"2020-07-01T14:18:41Z","modified":"2026-02-04T02:22:56.615519Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1805-1","title":"Security update for ntp","description":"This update for ntp fixes the following issues:\n\nntp was updated to 4.2.8p15\n\n- CVE-2020-11868: Fixed an issue which a server mode packet with spoofed source address \n  frequently send to the client ntpd could have caused denial of service (bsc#1169740).\n- CVE-2018-8956: Fixed an issue which could have allowed remote attackers to prevent \n  a broadcast client from synchronizing its clock with a broadcast NTP server via spoofed \n  mode 3 and mode 5 packets (bsc#1171355).\n- CVE-2020-13817: Fixed an issue which an off-path attacker with the ability to query time \n  from victim's ntpd instance could have modified the victim's clock by a limited amount (bsc#1172651).\n- CVE-2020-15025: Fixed an issue which remote attacker could have caused denial of service by consuming \n  the memory when a CMAC key was used andassociated with a CMAC algorithm in the ntp.keys (bsc#1173334).\t  \n","status":"published","published":"2020-06-30T15:37:45Z","modified":"2026-02-04T03:20:09.077271Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1823-1","title":"Security update for ntp","description":"This update for ntp fixes the following issues:\n\nntp was updated to 4.2.8p15\n\n- CVE-2020-11868: Fixed an issue which a server mode packet with spoofed source address \n  frequently send to the client ntpd could have caused denial of service (bsc#1169740).\n- CVE-2018-8956: Fixed an issue which could have allowed remote attackers to prevent \n  a broadcast client from synchronizing its clock with a broadcast NTP server via spoofed \n  mode 3 and mode 5 packets (bsc#1171355).\n- CVE-2020-13817: Fixed an issue which an off-path attacker with the ability to query time \n  from victim's ntpd instance could have modified the victim's clock by a limited amount (bsc#1172651).\n- CVE-2020-15025: Fixed an issue which remote attacker could have caused denial of service by consuming \n  the memory when a CMAC key was used andassociated with a CMAC algorithm in the ntp.keys (bsc#1173334).\n- Removed an OpenSSL version warning (bsc#992038 and bsc#1125401).\n","status":"published","published":"2020-07-02T09:32:43Z","modified":"2026-02-04T02:53:04.936713Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"USN-5175-1","title":"ntp vulnerability","description":"It was discovered that ntpd incorrectly handled memory when CMAC keys\nwere used. A remote attacker could possibly use this issue to cause ntpd to\ncrash resulting in a denial of service.\n","status":"published","published":"2021-12-06T14:10:56Z","modified":"2026-02-10T04:42:24Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}