GitHub Advisoryadvisory · crates.io
GHSA-37xq-q42p-rv3p ntpd has Dependency on Vulnerable Third-Party Component
LOW
Official page ↗
- Ecosystem
- crates.io
- Packages
- ntpd
- Severity
- Low
- CVSS vector
- CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
- Weaknesses
- CWE-1395
- Reviewed
- 2023-08-24
Affected packages
• crates.io ntpd: < 0.3.7 → fixed in 0.3.7
Description
During startup, an attacker that can man-in-the-middle traffic to and from NTS key exchange servers can trigger a very expensive key validation process due to a vulnerability in webpki.
Impact
This vulnerability can lead to excessive cpu usage on startup on clients configured to use NTS
Patches
Affected users are recommended to upgrade to version 0.3.7
References
See also https://github.com/rustsec/advisory-db/blob/main/crates/rustls-webpki/RUSTSEC-2023-0053.md
Related
Weakness · CWE (1)
- CWE-1395 Dependency on Vulnerable Third-Party Component weakness
References
- https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-37xq-q42p-rv3p web
- https://github.com/pendulum-project/ntpd-rs/commit/927952a440176a18f3ded132eb831ae7f7ac5c00 web
- https://github.com/pendulum-project/ntpd-rs package
- https://github.com/rustsec/advisory-db/blob/main/crates/rustls-webpki/RUSTSEC-2023-0053.md web