CVE-2024-38528

nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. There is a missing limit for accepted NTS-KE connections. This allows an unauthenticated remote attacker to crash ntpd-rs when an NTS-KE server is configured. Non NTS-KE server configurations, such as the default ntpd-rs configuration, are unaffected. This vulnerability has been patched in version 1.1.3.

References

Affected packages

Debian:13 / rust-ntpd

Package

Name: rust-ntpd
Purl: pkg:deb/debian/rust-ntpd?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.1.3-1

Affected versions

1.*

1.0.0-1

1.0.0-2

1.0.0-3

1.0.0-4

1.0.0-5

1.1.0-1

1.1.0-2

1.1.0-3

1.1.1-1

1.1.1-2

1.1.2-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}