{"answers":{"affected":"2 open source packages ship an affected version, including ntpd.","exploited":"There is no known exploitation of GHSA-v83q-83hj-rw38 in the wild and no public exploit code.","fix":"Upgrade ntpd to 1.5.0 or later.","what":"GHSA-v83q-83hj-rw38 is a denial of service vulnerability in ntpd, published on 28 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-v83q-83hj-rw38 and fix it if it is affected.\n\nWhat it is: GHSA-v83q-83hj-rw38 is a denial of service vulnerability in ntpd, published on 28 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-v83q-83hj-rw38 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- ntpd (crates.io): affected all versions; fixed in 1.5.0\n- ntpd (crates.io): affected all versions; fixed in 1.5.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-v83q-83hj-rw38/ (Markdown: https://insights.sbomify.com/GHSA-v83q-83hj-rw38/index.md)","id":"GHSA-v83q-83hj-rw38","markdown":"https://insights.sbomify.com/GHSA-v83q-83hj-rw38/index.md","name":"GHSA-v83q-83hj-rw38","record":{"aliases":[],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":true,"product_category":"NTP time daemon","requires_auth":"none","summary":"A malicious NTS server can crash ntpd-rs by sending zero-sized or oversized cookies, requiring the use of untrusted NTS sources.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Two denial of service vulnerabilities were found in ntpd-rs related to the handling of NTS cookies in our client functionality. Whenever an NTS source is configured and the server behind that source is sending zero-sized cookies or cookies larger than what would fit in our buffer size, ntpd-rs would crash. Only configured NTS sources can abuse these vulnerabilities. NTP sources or third parties that are not configured cannot make use of these vulnerabilities.\n\nFor zero-sized cookies: a division by zero would force an exit when the number of new cookies that would need to be requested is calculated. In ntpd-rs 1.5.0 a check was added to prevent the division by zero.\n\nFor large cookies: while trying to send a NTP request with the cookie included, the buffer is too small to handle the cookie and an exit of ntpd-rs is forced once a write to the buffer is attempted. The memory outside the buffer would not be written to in this case. In ntpd-rs 1.5.0 a check was added that prevents accepting cookies larger than 350 bytes.\n\nUsers of older versions of ntpd-rs are recommended to update to the latest version. If an update is impossible, it is recommended to only add NTS sources to ntpd-rs that are trusted to not abuse this bug.","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"ntpd NTS client denial of service via wrongly sized cookies","id":"GHSA-v83q-83hj-rw38","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"denial_of_service","year":"2025"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["1.5.0"],"introduced":["0"],"last_affected":[],"package":"ntpd","purl":null,"source":"GHSA-v83q-83hj-rw38"},{"ecosystem":"crates.io","fixed":["1.5.0"],"introduced":["0"],"last_affected":[],"package":"ntpd","purl":"pkg:cargo/ntpd","source":"GHSA-v83q-83hj-rw38"}],"products":null,"published":"2025-02-28","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"A malicious NTS server can crash ntpd-rs by sending zero-sized or oversized cookies, requiring the use of untrusted NTS sources.","url":"https://insights.sbomify.com/GHSA-v83q-83hj-rw38/"}