Red Hat Security Advisory

RHSA-2015:2241

chrony security, bug fix, and enhancement update

Released 2015-11-19 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) chrony-2.1.1-1.el7
Red Hat Enterprise Linux ComputeNode (v. 7) chrony-2.1.1-1.el7
Red Hat Enterprise Linux Server (v. 7) chrony-2.1.1-1.el7
Red Hat Enterprise Linux Workstation (v. 7) chrony-2.1.1-1.el7

Fixes 3 records

TI-2015-01638 CVE-2015-1821 · GHSA-cm73-xw9w-xqmm

Heap-based buffer overflow in chrony before 1.31.1 allows remote authenticated users to…

LOW 35

Heap-based buffer overflow in chrony before 1.31.1 allows remote authenticated users to cause a denial of service (chronyd crash) or possibly execute arbitrary code by configuring the (1) NTP or (2) cmdmon access with a…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.03414 Published 2015-04-16 Fixed CWE-119

TI-2015-01639 CVE-2015-1822 · GHSA-rchf-p2rm-hg6h

chrony before 1.31.1 does not initialize the last "next" pointer when saving…

LOW 34

chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer derefer…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.02936 Published 2015-04-16 Fixed CWE-17

TI-2015-01664 CVE-2015-1853 · GHSA-gf8j-j7q8-vhh5

chrony before 1.31.1 does not properly protect state variables in authenticated symmetric…

LOW 32

chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers with knowledge of NTP peering to cause a denial of service (inability to synchroni…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01696 Published 2019-12-09 Fixed in 1.31.1