CVE search · CVE-2020-15025
CVE-2020-15025
medium 4.9
ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.
Details
- Status
- Modified
- Published
- Last changed
- Source
- cve@mitre.org
- Weakness
- CWE-401
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | medium 4.4 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H |
cve@mitre.orgSecondary |
| CVSS 3.1 | medium 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
nvd@nist.govPrimary |
| CVSS 2.0 | medium 4.0 | AV:N/AC:L/Au:S/C:N/I:N/A:P |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- ntp · ntp
- opensuse · leap
- netapp · cloud_backup
- netapp · steelstore_cloud_integrated_storage
- netapp · 8300_firmware
- netapp · 8700_firmware
- netapp · a400_firmware
- netapp · h410c_firmware
- netapp · h300s_firmware
- netapp · h500s_firmware
- netapp · h700s_firmware
- netapp · h300e_firmware
- netapp · h500e_firmware
- netapp · h700e_firmware
- netapp · h410s_firmware
- oracle · zfs_storage_appliance_kit
References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.htmlMailing ListThird Party Advisory
- https://bugs.gentoo.org/729458Issue TrackingThird Party Advisory
- https://security.gentoo.org/glsa/202007-12Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200702-0002/Third Party Advisory
- https://support.ntp.org/bin/view/Main/NtpBug3661Vendor Advisory
- https://support.ntp.org/bin/view/Main/SecurityNotice#June_2020_ntp_4_2_8p15_NTP_ReleaRelease NotesVendor Advisory
- https://www.oracle.com/security-alerts/cpujan2021.htmlPatchThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.htmlMailing ListThird Party Advisory
- https://bugs.gentoo.org/729458Issue TrackingThird Party Advisory
- https://security.gentoo.org/glsa/202007-12Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200702-0002/Third Party Advisory
- https://support.ntp.org/bin/view/Main/NtpBug3661Vendor Advisory
- https://support.ntp.org/bin/view/Main/SecurityNotice#June_2020_ntp_4_2_8p15_NTP_ReleaRelease NotesVendor Advisory
- https://www.oracle.com/security-alerts/cpujan2021.htmlPatchThird Party Advisory