CVE-2021-22212

Katalog CVE

CVSS 7.4 · High EPSS 0,52%

Kerentanan Use of a Broken or Risky Cryptographic Algorithm pada ntpsec, fedoraproject fedora. Skor CVSS 3.1 7.4 (High) menurut NVD.

Deskripsi (NVD)

ntpkeygen can generate keys that ntpd fails to parse. NTPsec 1.2.0 allows ntpkeygen to generate keys with '#' characters. ntpd then either pads, shortens the key, or fails to load these keys entirely, depending on the key type and the placement of the '#'. This results in the administrator not being able to use the keys as expected or the keys are shorter than expected and easier to brute-force, possibly resulting in MITM attacks between ntp clients and ntp servers. For short AES128 keys, ntpd generates a warning that it is padding them.

Rincian

Terbit di NVD

8 Juni 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.4 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-327: Use of a Broken or Risky Cryptographic Algorithm

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=1955859 issue tracking · patch · advisory pihak ketiga
• https://gitlab.com/NTPsec/ntpsec/-/issues/699 issue tracking · patch · advisory pihak ketiga
• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22212.json advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3GIT2HYL5BQXP...