Log in Start free

Vulnerability · Published Jun 8, 2021 · Assigned by GitLab

CVE-2021-22212

Medium 4.0

In plain English

A medium-severity security flaw in ntpsec from NTPsec. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.0Medium
Exploit odds (30 days)0.5%top 55.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

ntpkeygen can generate keys that ntpd fails to parse. NTPsec 1.2.0 allows ntpkeygen to generate keys with '#' characters. ntpd then either pads, shortens the key, or fails to load these keys entirely, depending on the key type and the placement of the '#'. This results in the administrator not being able to use the keys as expected or the keys are shorter than expected and easier to brute-force, possibly resulting in MITM attacks between ntp clients and ntp servers. For short AES128 keys, ntpd generates a warning that it is padding them.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20ntpsec1.2.1-r0ALPINE-CVE-2021-22212
Alpine:v3.21ntpsec1.2.1-r0ALPINE-CVE-2021-22212
Alpine:v3.22ntpsec1.2.1-r0ALPINE-CVE-2021-22212
Alpine:v3.23ntpsec1.2.1-r0ALPINE-CVE-2021-22212
Alpine:v3.24ntpsec1.2.1-r0ALPINE-CVE-2021-22212
Debian:12ntpsec1.2.0+dfsg1-4DEBIAN-CVE-2021-22212
Debian:13ntpsec1.2.0+dfsg1-4DEBIAN-CVE-2021-22212
Debian:14ntpsec1.2.0+dfsg1-4DEBIAN-CVE-2021-22212

Affected products (as reported)

VendorProductVersions
NTPsec ntpsec =1.2.0

References