Search
Find a vulnerability
Search criteria
3 vulnerabilities found for ntpsec by NTPsec
CVE-2026-18321 (GCVE-0-2026-18321)
Vulnerability from cvelistv5 – Published: 2026-07-31 18:04 – Updated: 2026-07-31 18:54
VLAI
EPSS
VEX
Title
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in ntpsec
Summary
Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-31 18:54 UTC
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18321",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T18:54:02.722476Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T18:54:10.546Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ntpsec",
"vendor": "NTPsec",
"versions": [
{
"lessThan": "1.2.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Youngjoon Kim of Team Atlanta"
}
],
"descriptions": [
{
"lang": "en",
"value": "Buffer overflow in NTPsec\u0027s Zyfer refclock allows local attacker to crash ntpd"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T18:04:06.697Z",
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab"
},
"references": [
{
"url": "https://gitlab.com/NTPsec/ntpsec/-/work_items/890"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to version 1.2.5"
}
],
"title": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027) in ntpsec"
}
},
"cveMetadata": {
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"cveId": "CVE-2026-18321",
"datePublished": "2026-07-31T18:04:06.697Z",
"dateReserved": "2026-07-29T19:04:09.259Z",
"dateUpdated": "2026-07-31T18:54:10.546Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-4012 (GCVE-0-2023-4012)
Vulnerability from cvelistv5 – Published: 2023-08-07 17:30 – Updated: 2026-06-22 04:07
VLAI
EPSS
VEX
Title
Incomplete Internal State Distinction in ntpsec
Summary
ntpd will crash if the server is not NTS-enabled (no certificate) and it receives an NTS-enabled client request (mode 3).
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-30 15:47 UTC
CWE
- CWE-372 - Incomplete Internal State Distinction
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://gitlab.com/NTPsec/ntpsec/-/issues/794 | issue-tracking |
| https://bugs.debian.org/cgi-bin/bugreport.cgi?bug… |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T07:17:11.104Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "GitLab Issue #794",
"tags": [
"issue-tracking",
"x_transferred"
],
"url": "https://gitlab.com/NTPsec/ntpsec/-/issues/794"
},
{
"tags": [
"x_transferred"
],
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1038422"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-4012",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-30T15:47:43.075359Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-30T15:47:52.675Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ntpsec",
"vendor": "NTPsec",
"versions": [
{
"status": "affected",
"version": "1.2.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "R.L. Nicholas"
}
],
"descriptions": [
{
"lang": "en",
"value": "ntpd will crash if the server is not NTS-enabled (no certificate) and it receives an NTS-enabled client request (mode 3)."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-372",
"description": "CWE-372: Incomplete Internal State Distinction",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-22T04:07:22.152Z",
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab"
},
"references": [
{
"name": "GitLab Issue #794",
"tags": [
"issue-tracking"
],
"url": "https://gitlab.com/NTPsec/ntpsec/-/issues/794"
},
{
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1038422"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to version 1.2.2a or 1.2.3"
}
],
"title": "Incomplete Internal State Distinction in ntpsec"
}
},
"cveMetadata": {
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"cveId": "CVE-2023-4012",
"datePublished": "2023-08-07T17:30:33.452Z",
"dateReserved": "2023-07-31T09:01:28.128Z",
"dateUpdated": "2026-06-22T04:07:22.152Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-22212 (GCVE-0-2021-22212)
Vulnerability from cvelistv5 – Published: 2021-06-08 12:07 – Updated: 2024-08-03 18:37
VLAI
EPSS
VEX
Summary
ntpkeygen can generate keys that ntpd fails to parse. NTPsec 1.2.0 allows ntpkeygen to generate keys with '#' characters. ntpd then either pads, shortens the key, or fails to load these keys entirely, depending on the key type and the placement of the '#'. This results in the administrator not being able to use the keys as expected or the keys are shorter than expected and easier to brute-force, possibly resulting in MITM attacks between ntp clients and ntp servers. For short AES128 keys, ntpd generates a warning that it is padding them.
Severity
4 (Medium)
CWE
- Improper filtering of special elements in ntpsec
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://gitlab.com/NTPsec/ntpsec/-/issues/699 | x_refsource_MISC |
| https://bugzilla.redhat.com/show_bug.cgi?id=1955859 | x_refsource_MISC |
| https://gitlab.com/gitlab-org/cves/-/blob/master/… | x_refsource_CONFIRM |
| https://lists.fedoraproject.org/archives/list/pac… | vendor-advisoryx_refsource_FEDORA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:37:18.446Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gitlab.com/NTPsec/ntpsec/-/issues/699"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1955859"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22212.json"
},
{
"name": "FEDORA-2021-3ffc890685",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3GIT2HYL5BQXPGKI6ZDNG473IEQ5WQF2/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ntpsec",
"vendor": "NTPsec",
"versions": [
{
"status": "affected",
"version": "=1.2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Maciej Zenczykowski"
}
],
"descriptions": [
{
"lang": "en",
"value": "ntpkeygen can generate keys that ntpd fails to parse. NTPsec 1.2.0 allows ntpkeygen to generate keys with \u0027#\u0027 characters. ntpd then either pads, shortens the key, or fails to load these keys entirely, depending on the key type and the placement of the \u0027#\u0027. This results in the administrator not being able to use the keys as expected or the keys are shorter than expected and easier to brute-force, possibly resulting in MITM attacks between ntp clients and ntp servers. For short AES128 keys, ntpd generates a warning that it is padding them."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper filtering of special elements in ntpsec",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-26T02:06:11.000Z",
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://gitlab.com/NTPsec/ntpsec/-/issues/699"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1955859"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22212.json"
},
{
"name": "FEDORA-2021-3ffc890685",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3GIT2HYL5BQXPGKI6ZDNG473IEQ5WQF2/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@gitlab.com",
"ID": "CVE-2021-22212",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "ntpsec",
"version": {
"version_data": [
{
"version_value": "=1.2.0"
}
]
}
}
]
},
"vendor_name": "NTPsec"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Maciej Zenczykowski"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "ntpkeygen can generate keys that ntpd fails to parse. NTPsec 1.2.0 allows ntpkeygen to generate keys with \u0027#\u0027 characters. ntpd then either pads, shortens the key, or fails to load these keys entirely, depending on the key type and the placement of the \u0027#\u0027. This results in the administrator not being able to use the keys as expected or the keys are shorter than expected and easier to brute-force, possibly resulting in MITM attacks between ntp clients and ntp servers. For short AES128 keys, ntpd generates a warning that it is padding them."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Improper filtering of special elements in ntpsec"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://gitlab.com/NTPsec/ntpsec/-/issues/699",
"refsource": "MISC",
"url": "https://gitlab.com/NTPsec/ntpsec/-/issues/699"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1955859",
"refsource": "MISC",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1955859"
},
{
"name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22212.json",
"refsource": "CONFIRM",
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22212.json"
},
{
"name": "FEDORA-2021-3ffc890685",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3GIT2HYL5BQXPGKI6ZDNG473IEQ5WQF2/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"cveId": "CVE-2021-22212",
"datePublished": "2021-06-08T12:07:02.000Z",
"dateReserved": "2021-01-05T00:00:00.000Z",
"dateUpdated": "2024-08-03T18:37:18.446Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}