CVE-2023-33192: tweedegolf ntpd-rs

csirt@kutim:~/threat-intel/cve/CVE-2023-33192

CVSS 7.5 · High EPSS 0,71%

Kerentanan Improper Handling of Length Parameter Inconsistency pada tweedegolf ntpd-rs. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

ntpd-rs is an NTP implementation written in Rust. ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the server expects. The server also crashes when it is not configured to handle NTS packets. The issue was caused by improper slice indexing. The indexing operations were replaced by safer alternatives that do not crash the ntpd-rs server process but instead properly handle the error condition. A patch was released in version 0.3.3.

Rincian

Terbit di NVD: 27 Mei 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-130: Improper Handling of Length Parameter Inconsistency
EPSS (30 hari): 0,71% peluang dieksploitasi; lebih tinggi dari 52,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
tweedegolf	ntpd-rs	Versi 0.3.0 hingga sebelum 0.3.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-qwhm-h7v3-mrjx mitigasi · advisory vendor
https://github.com/pendulum-project/ntpd-rs/pull/752 patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.