SB2023082456 - Dependency on vulnerable third-party component in ntpd-rs

Description

This security bulletin contains information about 1 vulnerability.

1) Dependency on vulnerable third-party component (CVE-ID: N/A)

CWE-ID: CWE-1395 - Dependency on Vulnerable Third-Party Component

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to cause excessive cpu usage during startup.

The vulnerability exists due to dependency on a vulnerable third-party component in the NTS key validation process when performing NTS key exchange during startup. A remote attacker can man-in-the-middle traffic to and from NTS key exchange servers to cause excessive cpu usage during startup.

Only clients configured to use NTS are vulnerable.

Remediation

Install update from vendor's website.

References

• https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-37xq-q42p-rv3p
• https://github.com/advisories/GHSA-37xq-q42p-rv3p