version 1.1.3 was released on January 13th and fixes several issues.
Fixes 4 CVE: CVE-2019-6443 CVE-2019-6444 CVE-2019-6445 CVE-2019-6442
This is a security bug
(https://nvd.nist.gov/vuln/detail/CVE-2019-6445): An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can cause a NULL pointer dereference and ntpd crash in ntp_control.c, related to ctl_getitem. (https://nvd.nist.gov/vuln/detail/CVE-2019-6444): An issue was discovered in NTPsec before 1.1.3. process_control() in ntp_control.c has a stack-based buffer over-read because attacker-controlled data is dereferenced by ntohl() in ntpd. (https://nvd.nist.gov/vuln/detail/CVE-2019-6443): An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_control.c in ntp (https://nvd.nist.gov/vuln/detail/CVE-2019-6442): An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can write one byte out of bounds in ntpd via a malformed config request, related to config_remotely in ntp_config.c, yyparse in ntp_parser.tab.c, and yyerror in ntp_parser.y. @security, Alias please?
ntpsec-1.1.3 is on the tree, and the vulnerable versions are off.
(In reply to Anthony Basile from comment #4) > ntpsec-1.1.3 is on the tree, and the vulnerable versions are off. Thanks, Doc!
CVE-2019-6445 (https://nvd.nist.gov/vuln/detail/CVE-2019-6445): An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can cause a NULL pointer dereference and ntpd crash in ntp_control.c, related to ctl_getitem. CVE-2019-6444 (https://nvd.nist.gov/vuln/detail/CVE-2019-6444): An issue was discovered in NTPsec before 1.1.3. process_control() in ntp_control.c has a stack-based buffer over-read because attacker-controlled data is dereferenced by ntohl() in ntpd. CVE-2019-6443 (https://nvd.nist.gov/vuln/detail/CVE-2019-6443): An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_control.c in ntpd. CVE-2019-6442 (https://nvd.nist.gov/vuln/detail/CVE-2019-6442): An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can write one byte out of bounds in ntpd via a malformed config request, related to config_remotely in ntp_config.c, yyparse in ntp_parser.tab.c, and yyerror in ntp_parser.y.