CVE-2016-5117

MEDIUM 5.9CVE-2016-5117 · Published 31/01/2017 · updated 17/06/2026

In short

CVE-2016-5117 is a MEDIUM (CVSS 5.9) vulnerability affecting openntpd (openntpd).
Chance of exploitation in the next 30 days (EPSS): 0.70%, higher than 53.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
openntpd openntpd	`≤ 6.0`	No fix yet

Description

OpenNTPD before 6.0p1 does not validate the CN for HTTPS constraint requests, which allows remote attackers to bypass the man-in-the-middle mitigations via a crafted timestamp constraint with a valid certificate.

References

cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/ntpd/constraint.c.diff · Patch
openntpd.org/txt/release-6.0p1.txt · Vendor Advisory
openwall.com/lists/oss-security/2016/05/23/2 · Mailing List
openwall.com/lists/oss-security/2016/05/29/6 · Mailing List

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free