{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2020-11868","sourceIdentifier":"cve@mitre.org","published":"2020-04-17T04:15:10.987","lastModified":"2026-06-17T02:50:56.923","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp."},{"lang":"es","value":"ntpd en ntp versiones anteriores a 4.2.8p14 y versiones 4.3.x anteriores a 4.3.100, permite a un atacante fuera de ruta bloquear una sincronización no autenticada por medio de un paquete en modo server con una dirección IP de origen falsificado, porque las transmisiones son reprogramados aun cuando un paquete carece de una marca de tiempo de origen valido."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV30":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-23T13:13:41.284632Z","id":"CVE-2020-11868","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-346"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-346"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*","versionEndIncluding":"4.2.7","matchCriteriaId":"8E63507D-C475-4379-85A5-185F19BEDCEE"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.98","versionEndExcluding":"4.3.100","matchCriteriaId":"DCEB0CC2-6D54-4206-87DA-24ABA3C4867F"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:-:*:*:*:*:*:*","matchCriteriaId":"EEA51D83-5841-4335-AF07-7A43C118CAAE"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p1:*:*:*:*:*:*","matchCriteriaId":"C855BBD2-2B38-4EFF-9DBE-CA61CCACD0DE"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p1-beta1:*:*:*:*:*:*","matchCriteriaId":"49ADE0C3-F75C-4EC0-8805-56013F0EB92C"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p1-beta2:*:*:*:*:*:*","matchCriteriaId":"D8FF625A-EFA3-43D1-8698-4A37AE31A07C"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p1-beta3:*:*:*:*:*:*","matchCriteriaId":"E3B99BBD-97FE-4615-905A-A614592226F8"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p1-beta4:*:*:*:*:*:*","matchCriteriaId":"E7A9AD3A-F030-4331-B52A-518BD963AB8A"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p1-beta5:*:*:*:*:*:*","matchCriteriaId":"C293B8BE-6691-4944-BCD6-25EB98CABC73"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p1-rc1:*:*:*:*:*:*","matchCriteriaId":"CEA650F8-2576-494A-A861-61572CA319D0"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p1-rc2:*:*:*:*:*:*","matchCriteriaId":"4ED21EE8-7CBF-4BC5-BFC3-185D41296238"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p10:*:*:*:*:*:*","matchCriteriaId":"0BC62D4E-D519-458C-BE4E-10DDB73A97D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p11:*:*:*:*:*:*","matchCriteriaId":"1C420117-862A-41A9-BAE8-8B3478FAEBC3"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p12:*:*:*:*:*:*","matchCriteriaId":"4A484251-3220-498C-83FE-A04B013A31A4"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p13:*:*:*:*:*:*","matchCriteriaId":"E0CE4157-852B-42ED-A77C-8A17B189432E"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p2:*:*:*:*:*:*","matchCriteriaId":"C76A0B44-13DE-4173-8D05-DA54F6A71759"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p2-rc1:*:*:*:*:*:*","matchCriteriaId":"1450241C-2F6D-4122-B33C-D78D065BA403"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p2-rc2:*:*:*:*:*:*","matchCriteriaId":"721AFD22-91D3-488E-A5E6-DD84C86E412B"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p2-rc3:*:*:*:*:*:*","matchCriteriaId":"8D6ADDB1-2E96-4FF6-AE95-4B06654D38B0"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p3:*:*:*:*:*:*","matchCriteriaId":"41E44E9F-6383-4E12-AEDC-B653FEA77A48"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p3-rc1:*:*:*:*:*:*","matchCriteriaId":"466D9A37-2658-4695-9429-0C6BF4A631C2"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p3-rc2:*:*:*:*:*:*","matchCriteriaId":"99774181-5F12-446C-AC2C-DB1C52295EED"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p3-rc3:*:*:*:*:*:*","matchCriteriaId":"4427EE6D-3F79-4FF5-B3EC-EE6BD01562CE"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p4:*:*:*:*:*:*","matchCriteriaId":"99C71C00-7222-483B-AEFB-159337BD3C92"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p5:*:*:*:*:*:*","matchCriteriaId":"75A9AA28-1B20-44BB-815C-7294A53E910E"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p6:*:*:*:*:*:*","matchCriteriaId":"8C213794-111D-41F3-916C-AD97F731D600"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p7:*:*:*:*:*:*","matchCriteriaId":"50811A7B-0379-4437-8737-B4C1ACBC9EFD"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p8:*:*:*:*:*:*","matchCriteriaId":"F12E4CF5-536C-416B-AD8D-6AE7CBE22C71"},{"vulnerable":true,"criteria":"cpe:2.3:a:ntp:ntp:4.2.8:p9:*:*:*:*:*:*","matchCriteriaId":"EE002C76-406D-4F22-B738-E17BDEA70BCC"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*","matchCriteriaId":"142AD0DD-4CF3-4D74-9442-459CE3347E3A"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:netapp:data_ontap:-:*:*:*:*:7-mode:*:*","matchCriteriaId":"6C2ACC32-5147-4EA5-95BE-B6B4EAB3D82B"},{"vulnerable":true,"criteria":"cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*","matchCriteriaId":"A3C19813-E823-456A-B1CE-EC0684CE1953"},{"vulnerable":true,"criteria":"cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*","matchCriteriaId":"A6E9EF0C-AFA8-4F7B-9FDC-1E0F7C26E737"},{"vulnerable":true,"criteria":"cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:*","versionStartIncluding":"7.2","matchCriteriaId":"13270F58-E106-48CE-9933-E68AABBBFC21"},{"vulnerable":true,"criteria":"cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:vsphere:*:*","versionStartIncluding":"7.2","matchCriteriaId":"A81C8303-BB94-4D35-9823-44385C375F67"},{"vulnerable":true,"criteria":"cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vsphere:*:*","versionStartIncluding":"7.2","matchCriteriaId":"066C2961-E9C4-418E-82AF-1A7C35D5C085"},{"vulnerable":true,"criteria":"cpe:2.3:o:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*","matchCriteriaId":"1FED6CAE-D97F-49E0-9D00-1642A3A427B4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:netapp:hci_storage_node_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4BC4299D-05D3-4875-BC79-C3DC02C88ECE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:*","matchCriteriaId":"02DEB4FB-A21D-4CB1-B522-EEE5093E8521"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:netapp:fabric-attached_storage_8300_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"299AD352-A486-44A7-8507-FB3C3311BB37"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:netapp:fabric-attached_storage_8300:-:*:*:*:*:*:*:*","matchCriteriaId":"43E89C80-A70B-48A3-A076-D9F031C25D1C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:netapp:fabric-attached_storage_8700_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE584D20-5B46-42B9-B87D-5F4771CED73F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:netapp:fabric-attached_storage_8700:-:*:*:*:*:*:*:*","matchCriteriaId":"DF9B5939-68D6-47E1-AFCA-F709F46136C6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:netapp:fabric-attached_storage_a400_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0BA5679F-B7F4-482B-92B3-52121124829F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:netapp:fabric-attached_storage_a400:-:*:*:*:*:*:*:*","matchCriteriaId":"02F063AC-FC82-45E4-A977-243FB3569904"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:netapp:all_flash_fabric-attached_storage_8300_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A5753F36-9BB4-47FF-806C-D1C77E8AD0F0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:netapp:all_flash_fabric-attached_storage_8300:-:*:*:*:*:*:*:*","matchCriteriaId":"BA68733C-FB68-4230-B237-C99AC979AD90"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:netapp:all_flash_fabric-attached_storage_8700_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2A0F881B-5A23-42F7-8A6B-02BDD10A74DA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:netapp:all_flash_fabric-attached_storage_8700:-:*:*:*:*:*:*:*","matchCriteriaId":"049791FD-C7CE-43E0-8B7B-363B49B40D4A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:netapp:all_flash_fabric-attached_storage_a400_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"64532D9C-EE55-4C70-B230-54C9C20536FC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:netapp:all_flash_fabric-attached_storage_a400:-:*:*:*:*:*:*:*","matchCriteriaId":"2527D2C3-EDA7-4B8A-82AB-A4F20C731E2D"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*","matchCriteriaId":"B620311B-34A3-48A6-82DF-6F078D7A4493"},{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*","matchCriteriaId":"B009C22E-30A4-4288-BCF6-C3E81DEAF45A"}]}]}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://support.ntp.org/bin/view/Main/NtpBug3592","source":"cve@mitre.org","tags":["Patch","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1716665","source":"cve@mitre.org","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/05/msg00004.html","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/202007-12","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20200424-0002/","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://support.ntp.org/bin/view/Main/NtpBug3592","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1716665","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/05/msg00004.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/202007-12","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20200424-0002/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}}