Read the docs
TI-2020-09538 Aliases CVE-2020-11868GHSA-57qq-hwp2-xmcj

ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block…

Priority LOW 37CWE-346Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 8 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-346.

Summary

ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02116 81st percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 8 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 53

CPEVersionsRoleVendor
cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*up to 4.2.7; 4.3.98 to before 4.3.100VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:-:*:*:*:*:*:*4.2.8VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p1:*:*:*:*:*:*4.2.8 p1VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta1:*:*:*:*:*:*4.2.8 p1-beta1VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta2:*:*:*:*:*:*4.2.8 p1-beta2VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta3:*:*:*:*:*:*4.2.8 p1-beta3VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta4:*:*:*:*:*:*4.2.8 p1-beta4VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta5:*:*:*:*:*:*4.2.8 p1-beta5VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p1-rc1:*:*:*:*:*:*4.2.8 p1-rc1VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p1-rc2:*:*:*:*:*:*4.2.8 p1-rc2VulnerableNTP Project
  • cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:* Versions up to 4.2.7; 4.3.98 to before 4.3.100 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:-:*:*:*:*:*:* Versions 4.2.8 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p1:*:*:*:*:*:* Versions 4.2.8 p1 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p1-beta1:*:*:*:*:*:* Versions 4.2.8 p1-beta1 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p1-beta2:*:*:*:*:*:* Versions 4.2.8 p1-beta2 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p1-beta3:*:*:*:*:*:* Versions 4.2.8 p1-beta3 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p1-beta4:*:*:*:*:*:* Versions 4.2.8 p1-beta4 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p1-beta5:*:*:*:*:*:* Versions 4.2.8 p1-beta5 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p1-rc1:*:*:*:*:*:* Versions 4.2.8 p1-rc1 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p1-rc2:*:*:*:*:*:* Versions 4.2.8 p1-rc2 Vulnerable ·NTP Project
Show 43 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ntp:ntp:4.2.8:p10:*:*:*:*:*:*4.2.8 p10VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p11:*:*:*:*:*:*4.2.8 p11VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p12:*:*:*:*:*:*4.2.8 p12VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p13:*:*:*:*:*:*4.2.8 p13VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p2:*:*:*:*:*:*4.2.8 p2VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p2-rc1:*:*:*:*:*:*4.2.8 p2-rc1VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p2-rc2:*:*:*:*:*:*4.2.8 p2-rc2VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p2-rc3:*:*:*:*:*:*4.2.8 p2-rc3VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p3:*:*:*:*:*:*4.2.8 p3VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p3-rc1:*:*:*:*:*:*4.2.8 p3-rc1VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p3-rc2:*:*:*:*:*:*4.2.8 p3-rc2VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p3-rc3:*:*:*:*:*:*4.2.8 p3-rc3VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p4:*:*:*:*:*:*4.2.8 p4VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p5:*:*:*:*:*:*4.2.8 p5VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p6:*:*:*:*:*:*4.2.8 p6VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p7:*:*:*:*:*:*4.2.8 p7VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p8:*:*:*:*:*:*4.2.8 p8VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p9:*:*:*:*:*:*4.2.8 p9VulnerableNTP Project
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:netapp:data_ontap:-:*:*:*:*:7-mode:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:*7.2VulnerableNetApp
cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:vsphere:*:*7.2VulnerableNetApp
cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vsphere:*:*7.2VulnerableNetApp
cpe:2.3:o:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:o:netapp:hci_storage_node_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:netapp:fabric-attached_storage_8300_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:fabric-attached_storage_8300:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:netapp:fabric-attached_storage_8700_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:fabric-attached_storage_8700:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:netapp:fabric-attached_storage_a400_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:fabric-attached_storage_a400:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:netapp:all_flash_fabric-attached_storage_8300_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:all_flash_fabric-attached_storage_8300:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:netapp:all_flash_fabric-attached_storage_8700_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:all_flash_fabric-attached_storage_8700:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:netapp:all_flash_fabric-attached_storage_a400_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:all_flash_fabric-attached_storage_a400:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*15.2VulnerableopenSUSE
  • cpe:2.3:a:ntp:ntp:4.2.8:p10:*:*:*:*:*:* Versions 4.2.8 p10 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p11:*:*:*:*:*:* Versions 4.2.8 p11 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p12:*:*:*:*:*:* Versions 4.2.8 p12 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p13:*:*:*:*:*:* Versions 4.2.8 p13 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p2:*:*:*:*:*:* Versions 4.2.8 p2 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p2-rc1:*:*:*:*:*:* Versions 4.2.8 p2-rc1 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p2-rc2:*:*:*:*:*:* Versions 4.2.8 p2-rc2 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p2-rc3:*:*:*:*:*:* Versions 4.2.8 p2-rc3 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p3:*:*:*:*:*:* Versions 4.2.8 p3 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p3-rc1:*:*:*:*:*:* Versions 4.2.8 p3-rc1 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p3-rc2:*:*:*:*:*:* Versions 4.2.8 p3-rc2 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p3-rc3:*:*:*:*:*:* Versions 4.2.8 p3-rc3 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p4:*:*:*:*:*:* Versions 4.2.8 p4 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p5:*:*:*:*:*:* Versions 4.2.8 p5 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p6:*:*:*:*:*:* Versions 4.2.8 p6 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p7:*:*:*:*:*:* Versions 4.2.8 p7 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p8:*:*:*:*:*:* Versions 4.2.8 p8 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p9:*:*:*:*:*:* Versions 4.2.8 p9 Vulnerable ·NTP Project
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:netapp:data_ontap:-:*:*:*:*:7-mode:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:vsphere:*:* Versions 7.2 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vsphere:*:* Versions 7.2 Vulnerable ·NetApp
  • cpe:2.3:o:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:o:netapp:hci_storage_node_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:netapp:fabric-attached_storage_8300_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:fabric-attached_storage_8300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:netapp:fabric-attached_storage_8700_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:fabric-attached_storage_8700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:netapp:fabric-attached_storage_a400_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:fabric-attached_storage_a400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:netapp:all_flash_fabric-attached_storage_8300_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:all_flash_fabric-attached_storage_8300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:netapp:all_flash_fabric-attached_storage_8700_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:all_flash_fabric-attached_storage_8700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:netapp:all_flash_fabric-attached_storage_a400_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:all_flash_fabric-attached_storage_a400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE

Remediation

Red Hat 1 advisory

  • RHSA-2020:2663 Released 2020-06-23 · Red Hat rating Moderate
    ntp security update
    • Red Hat Enterprise Linux Client (v. 7) ntp-4.2.6p5-29.el7_8.2, ntpdate-4.2.6p5-29.el7_8.2
    • Red Hat Enterprise Linux Client Optional (v. 7) ntp-doc-4.2.6p5-29.el7_8.2, ntp-perl-4.2.6p5-29.el7_8.2, sntp-4.2.6p5-29.el7_8.2
    • Red Hat Enterprise Linux ComputeNode (v. 7) ntp-4.2.6p5-29.el7_8.2, ntpdate-4.2.6p5-29.el7_8.2
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) ntp-doc-4.2.6p5-29.el7_8.2, ntp-perl-4.2.6p5-29.el7_8.2, sntp-4.2.6p5-29.el7_8.2
    • Red Hat Enterprise Linux Server (v. 7) ntp-4.2.6p5-29.el7_8.2, ntpdate-4.2.6p5-29.el7_8.2
    • Red Hat Enterprise Linux Server Optional (v. 7) ntp-doc-4.2.6p5-29.el7_8.2, ntp-perl-4.2.6p5-29.el7_8.2, sntp-4.2.6p5-29.el7_8.2
    • Red Hat Enterprise Linux Workstation (v. 7) ntp-4.2.6p5-29.el7_8.2, ntpdate-4.2.6p5-29.el7_8.2
    • Red Hat Enterprise Linux Workstation Optional (v. 7) ntp-doc-4.2.6p5-29.el7_8.2, ntp-perl-4.2.6p5-29.el7_8.2, sntp-4.2.6p5-29.el7_8.2

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2020:2663
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2020:2663
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2020:2663
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2020:2663
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:2663
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2020:2663
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:2663
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2020:2663

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-11868
  2. 2026-10-03 Alias added: GHSA-57qq-hwp2-xmcj

References

Patch 2

Advisory 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences