Maple Labs

CVE search · CVE-2020-11868

CVE-2020-11868

high 7.5

ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp.

Open in the NVD CVE.org JSON

Details

Status
Modified
Published
Last changed
Source
cve@mitre.org
Weakness
CWE-346

Severity

VersionScoreVectorSource
CVSS 3.1 high 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H nvd@nist.govPrimary
CVSS 3.1 high 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary
CVSS 3.0 medium 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H cve@mitre.orgSecondary
CVSS 2.0 medium 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P nvd@nist.govPrimary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

  • ntp · ntp
  • redhat · enterprise_linux
  • netapp · data_ontap
  • netapp · hci_management_node
  • netapp · solidfire
  • netapp · vasa_provider_for_clustered_data_ontap
  • netapp · virtual_storage_console
  • netapp · clustered_data_ontap
  • netapp · hci_storage_node_firmware
  • netapp · fabric-attached_storage_8300_firmware
  • netapp · fabric-attached_storage_8700_firmware
  • netapp · fabric-attached_storage_a400_firmware
  • netapp · all_flash_fabric-attached_storage_8300_firmware
  • netapp · all_flash_fabric-attached_storage_8700_firmware
  • netapp · all_flash_fabric-attached_storage_a400_firmware
  • debian · debian_linux
  • opensuse · leap

References