p PatchFirst

CVE-2021-22212

CVE-2021-22212

This page contains facts from public vulnerability sources. Check the original advisory before updating.

ntpkeygen can generate keys that ntpd fails to parse. NTPsec 1.2.0 allows ntpkeygen to generate keys with '#' characters. ntpd then either pads, shortens the key, or fails to load these keys entirely, depending on the key type and the placement of the '#'. This results in the administrator not being able to use the keys as expected or the keys are shorter than expected and easier to brute-force, possibly resulting in MITM attacks between ntp clients and ntp servers. For short AES128 keys, ntpd generates a warning that it is padding them.

CVSS 4.0 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • ntpsec

    Versions
    • =1.2.0: Affected

    No fix published

  • ntpsec Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.2.0+dfsg1-4

    Update to 1.2.0+dfsg1-4

  • ntpsec Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.2.0+dfsg1-4

    Update to 1.2.0+dfsg1-4

  • ntpsec Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.2.0+dfsg1-4

    Update to 1.2.0+dfsg1-4

Original sources

Check your server →