Security update for ntp

Announcement ID: SUSE-SU-2023:2609-1
Rating: moderate
References:
Cross-References:
CVSS scores:
  • CVE-2023-26555 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2023-26555 ( NVD ): 6.4 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:
  • SUSE Linux Enterprise High Performance Computing 12 SP5
  • SUSE Linux Enterprise Server 12 SP5
  • SUSE Linux Enterprise Server for SAP Applications 12 SP5

An update that solves one vulnerability can now be installed.

Description:

This update for ntp fixes the following issues:

ntp was updated to 4.2.8p17:

  • Fix some regressions of 4.2.8p16

Update to 4.2.8p16:

  • [Sec 3808] Assertion failure in ntpq on malformed RT-11 date
  • [Sec 3807], bsc#1210390, CVE-2023-26555: praecis_parse() in the Palisade refclock driver has a hypothetical input buffer overflow.
  • [Sec 3767] An OOB KoD RATE value triggers an assertion when debug is enabled.
  • Multiple bug fixes and improvements. For details, see /usr/share/doc/packages/ntp/ChangeLog

http://www.ntp.org/support/securitynotice/4_2_8-series-changelog/

  • CVE-2023-26555: Fixed assertion failure on malformed RT-11 dates (bsc#1210390).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Linux Enterprise High Performance Computing 12 SP5
    zypper in -t patch SUSE-SLE-SERVER-12-SP5-2023-2609=1
  • SUSE Linux Enterprise Server 12 SP5
    zypper in -t patch SUSE-SLE-SERVER-12-SP5-2023-2609=1
  • SUSE Linux Enterprise Server for SAP Applications 12 SP5
    zypper in -t patch SUSE-SLE-SERVER-12-SP5-2023-2609=1

Package List:

  • SUSE Linux Enterprise High Performance Computing 12 SP5 (aarch64 x86_64)
    • ntp-debuginfo-4.2.8p17-103.1
    • ntp-4.2.8p17-103.1
    • ntp-doc-4.2.8p17-103.1
    • ntp-debugsource-4.2.8p17-103.1
  • SUSE Linux Enterprise Server 12 SP5 (aarch64 ppc64le s390x x86_64)
    • ntp-debuginfo-4.2.8p17-103.1
    • ntp-4.2.8p17-103.1
    • ntp-doc-4.2.8p17-103.1
    • ntp-debugsource-4.2.8p17-103.1
  • SUSE Linux Enterprise Server for SAP Applications 12 SP5 (ppc64le x86_64)
    • ntp-debuginfo-4.2.8p17-103.1
    • ntp-4.2.8p17-103.1
    • ntp-doc-4.2.8p17-103.1
    • ntp-debugsource-4.2.8p17-103.1

References: