CVE-2020-15025

Published: 24 June 2020

ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.

Priority

Cvss 3 Severity Score

4.9

Score breakdown

Status

Package	Release	Status
ntp Launchpad, Ubuntu, Debian	bionic	Not vulnerable (code not present)
	eoan	Ignored (end of life)
	trusty	Not vulnerable (code not present)
	upstream	Needs triage
	xenial	Not vulnerable (code not present)
	groovy	Ignored (end of life)
	jammy	Not vulnerable (1:4.2.8p15+dfsg-1ubuntu1)
	impish	Ignored (end of life)
	kinetic	Does not exist
	focal	Released (1:4.2.8p12+dfsg-3ubuntu4.20.04.1+esm1) Available with Ubuntu Pro
	hirsute	Ignored (end of life)
	lunar	Does not exist
	mantic	Does not exist
ntpsec Launchpad, Ubuntu, Debian	impish	Not vulnerable (code not present)
	groovy	Not vulnerable (code not present)
	kinetic	Not vulnerable (code not present)
	bionic	Not vulnerable (code not present)
	eoan	Not vulnerable (code not present)
	focal	Not vulnerable (code not present)
	hirsute	Not vulnerable (code not present)
	jammy	Not vulnerable (code not present)
	lunar	Not vulnerable (code not present)
	trusty	Does not exist
	upstream	Not vulnerable (debian: Vulnerable code not present)
	xenial	Does not exist
	mantic	Not vulnerable (code not present)

Severity score breakdown

Parameter	Value
Base score	4.9
Attack vector	Network
Attack complexity	Low
Privileges required	High
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›