This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2019-6442 →

DEBIAN-CVE-2019-6442

An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can write one byte out of bounds in ntpd via a malformed config request, rel...

Original description

The description as published by the source.

An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can write one byte out of bounds in ntpd via a malformed config request, related to config_remotely in ntp_config.c, yyparse in ntp_parser.tab.c, and yyerror in ntp_parser.y.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 ntpsec

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3+dfsg1-1"}]}]

Debian:13 ntpsec

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3+dfsg1-1"}]}]

Debian:14 ntpsec

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3+dfsg1-1"}]}]

References

advisory security-tracker.debian.org