| Package | Affected versions | Patched versions |
|---|---|---|
| chrony | = 1.0= 1.1= 1.18= 1.19= 1.19.99.1= 1.19.99.2= 1.19.99.3= 1.20= 1.21= 1.23= 1.23.1= 1.24= 1.25= 1.26= 1.27= 1.28≤ 1.28 |
cmdmon.c in Chrony before 1.29 allows remote attackers to obtain potentially sensitive information from stack memory via vectors related to (1) an invalid subnet in a RPY_SUBNETS_ACCESSED command to the handle_subnets_accessed function or (2) a RPY_CLIENT_ACCESSES command to the handle_client_accesses function when client logging is disabled, which causes uninitialized data to be included in a reply.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free