suse-su-2021:4147-1
Vulnerability from csaf_suse
Published
2021-12-22 08:24
Modified
2021-12-22 08:24
Summary
Security update for chrony

Notes

Title of the patch
Security update for chrony
Description of the patch
This update for chrony fixes the following issues: Chrony was updated to 4.1: * Add support for NTS servers specified by IP address (matching Subject Alternative Name in server certificate) * Add source-specific configuration of trusted certificates * Allow multiple files and directories with trusted certificates * Allow multiple pairs of server keys and certificates * Add copy option to server/pool directive * Increase PPS lock limit to 40% of pulse interval * Perform source selection immediately after loading dump files * Reload dump files for addresses negotiated by NTS-KE server * Update seccomp filter and add less restrictive level * Restart ongoing name resolution on online command * Fix dump files to not include uncorrected offset * Fix initstepslew to accept time from own NTP clients * Reset NTP address and port when no longer negotiated by NTS-KE server - Update clknetsim to snapshot f89702d. - Ensure the correct pool packages are installed for openSUSE and SLE (bsc#1180689). - Enable syscallfilter unconditionally (bsc#1181826). Chrony was updated to 4.0: Enhancements - Add support for Network Time Security (NTS) authentication - Add support for AES-CMAC keys (AES128, AES256) with Nettle - Add authselectmode directive to control selection of unauthenticated sources - Add binddevice, bindacqdevice, bindcmddevice directives - Add confdir directive to better support fragmented configuration - Add sourcedir directive and 'reload sources' command to support dynamic NTP sources specified in files - Add clockprecision directive - Add dscp directive to set Differentiated Services Code Point (DSCP) - Add -L option to limit log messages by severity - Add -p option to print whole configuration with included files - Add -U option to allow start under non-root user - Allow maxsamples to be set to 1 for faster update with -q/-Q option - Avoid replacing NTP sources with sources that have unreachable address - Improve pools to repeat name resolution to get 'maxsources' sources - Improve source selection with trusted sources - Improve NTP loop test to prevent synchronisation to itself - Repeat iburst when NTP source is switched from offline state to online - Update clock synchronisation status and leap status more frequently - Update seccomp filter - Add 'add pool' command - Add 'reset sources' command to drop all measurements - Add authdata command to print details about NTP authentication - Add selectdata command to print details about source selection - Add -N option and sourcename command to print original names of sources - Add -a option to some commands to print also unresolved sources - Add -k, -p, -r options to clients command to select, limit, reset data - Bug fixes - Don’t set interface for NTP responses to allow asymmetric routing - Handle RTCs that don’t support interrupts - Respond to command requests with correct address on multihomed hosts - Removed features - Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320) - Drop support for long (non-standard) MACs in NTPv4 packets (chrony 2.x clients using non-MD5/SHA1 keys need to use option 'version 3') - By default we don't write log files but log to journald, so only recommend logrotate. - Adjust and rename the sysconfig file, so that it matches the expectations of chronyd.service (bsc#1173277). Chrony was updated to 3.5.1: * Create new file when writing pidfile (CVE-2020-14367, bsc#1174911) - Add chrony-pool-suse and chrony-pool-openSUSE subpackages that preconfigure chrony to use NTP servers from the respective pools for SUSE and openSUSE (bsc#1156884, SLE-11424). - Add chrony-pool-empty to still allow installing chrony without preconfigured servers. - Use iburst in the default pool statements to speed up initial synchronisation (bsc#1172113). - Update clknetsim to version 79ffe44 (fixes bsc#1162964). Update to 3.5: + Add support for more accurate reading of PHC on Linux 5.0 + Add support for hardware timestamping on interfaces with read-only timestamping configuration + Add support for memory locking and real-time priority on FreeBSD, NetBSD, Solaris + Update seccomp filter to work on more architectures + Validate refclock driver options + Fix bindaddress directive on FreeBSD + Fix transposition of hardware RX timestamp on Linux 4.13 and later + Fix building on non-glibc systems - Fix location of helper script in chrony-dnssrv@.service (bsc#1128846). - Read runtime servers from /var/run/netconfig/chrony.servers (bsc#1099272) - Move chrony-helper to /usr/lib/chrony/helper, because there should be no executables in /usr/share. - Remove discrepancies between spec file and chrony-tmpfiles (bsc#1115529) Update to version 3.4 * Enhancements + Add filter option to server/pool/peer directive + Add minsamples and maxsamples options to hwtimestamp directive + Add support for faster frequency adjustments in Linux 4.19 + Change default pidfile to /var/run/chrony/chronyd.pid to allow chronyd without root privileges to remove it on exit + Disable sub-second polling intervals for distant NTP sources + Extend range of supported sub-second polling intervals + Get/set IPv4 destination/source address of NTP packets on FreeBSD + Make burst options and command useful with short polling intervals + Modify auto_offline option to activate when sending request failed + Respond from interface that received NTP request if possible + Add onoffline command to switch between online and offline state according to current system network configuration + Improve example NetworkManager dispatcher script * Bug fixes + Avoid waiting in Linux getrandom system call + Fix PPS support on FreeBSD and NetBSD Update to version 3.3 * Enhancements: + Add burst option to server/pool directive + Add stratum and tai options to refclock directive + Add support for Nettle crypto library + Add workaround for missing kernel receive timestamps on Linux + Wait for late hardware transmit timestamps + Improve source selection with unreachable sources + Improve protection against replay attacks on symmetric mode + Allow PHC refclock to use socket in /var/run/chrony + Add shutdown command to stop chronyd + Simplify format of response to manual list command + Improve handling of unknown responses in chronyc * Bug fixes: + Respond to NTPv1 client requests with zero mode + Fix -x option to not require CAP_SYS_TIME under non-root user + Fix acquisitionport directive to work with privilege separation + Fix handling of socket errors on Linux to avoid high CPU usage + Fix chronyc to not get stuck in infinite loop after clock step - Added /etc/chrony.d/ directory to the package (bsc#1083597) Modifed default chrony.conf to add 'include /etc/chrony.d/*' - Enable pps support Upgraded to version 3.2: Enhancements * Improve stability with NTP sources and reference clocks * Improve stability with hardware timestamping * Improve support for NTP interleaved modes * Control frequency of system clock on macOS 10.13 and later * Set TAI-UTC offset of system clock with leapsectz directive * Minimise data in client requests to improve privacy * Allow transmit-only hardware timestamping * Add support for new timestamping options introduced in Linux 4.13 * Add root delay, root dispersion and maximum error to tracking log * Add mindelay and asymmetry options to server/peer/pool directive * Add extpps option to PHC refclock to timestamp external PPS signal * Add pps option to refclock directive to treat any refclock as PPS * Add width option to refclock directive to filter wrong pulse edges * Add rxfilter option to hwtimestamp directive * Add -x option to disable control of system clock * Add -l option to log to specified file instead of syslog * Allow multiple command-line options to be specified together * Allow starting without root privileges with -Q option * Update seccomp filter for new glibc versions * Dump history on exit by default with dumpdir directive * Use hardening compiler options by default Bug fixes * Don't drop PHC samples with low-resolution system clock * Ignore outliers in PHC tracking, RTC tracking, manual input * Increase polling interval when peer is not responding * Exit with error message when include directive fails * Don't allow slash after hostname in allow/deny directive/command * Try to connect to all addresses in chronyc before giving up Upgraded to version 3.1: - Enhancements - Add support for precise cross timestamping of PHC on Linux - Add minpoll, precision, nocrossts options to hwtimestamp directive - Add rawmeasurements option to log directive and modify measurements option to log only valid measurements from synchronised sources - Allow sub-second polling interval with NTP sources - Bug fixes - Fix time smoothing in interleaved mode Upgraded to version 3.0: - Enhancements - Add support for software and hardware timestamping on Linux - Add support for client/server and symmetric interleaved modes - Add support for MS-SNTP authentication in Samba - Add support for truncated MACs in NTPv4 packets - Estimate and correct for asymmetric network jitter - Increase default minsamples and polltarget to improve stability with very low jitter - Add maxjitter directive to limit source selection by jitter - Add offset option to server/pool/peer directive - Add maxlockage option to refclock directive - Add -t option to chronyd to exit after specified time - Add partial protection against replay attacks on symmetric mode - Don't reset polling interval when switching sources to online state - Allow rate limiting with very short intervals - Improve maximum server throughput on Linux and NetBSD - Remove dump files after start - Add tab-completion to chronyc with libedit/readline - Add ntpdata command to print details about NTP measurements - Allow all source options to be set in add server/peer command - Indicate truncated addresses/hostnames in chronyc output - Print reference IDs as hexadecimal numbers to avoid confusion with IPv4 addresses - Bug fixes - Fix crash with disabled asynchronous name resolving Upgraded to version 2.4.1: - Bug fixes - Fix processing of kernel timestamps on non-Linux systems - Fix crash with smoothtime directive - Fix validation of refclock sample times - Fix parsing of refclock directive update to 2.4: - Enhancements - Add orphan option to local directive for orphan mode compatible with ntpd - Add distance option to local directive to set activation threshold (1 second by default) - Add maxdrift directive to set maximum allowed drift of system clock - Try to replace NTP sources exceeding maximum distance - Randomise source replacement to avoid getting stuck with bad sources - Randomise selection of sources from pools on start - Ignore reference timestamp as ntpd doesn't always set it correctly - Modify tracking report to use same values as seen by NTP clients - Add -c option to chronyc to write reports in CSV format - Provide detailed manual pages - Bug fixes - Fix SOCK refclock to work correctly when not specified as last refclock - Fix initstepslew and -q/-Q options to accept time from own NTP clients - Fix authentication with keys using 512-bit hash functions - Fix crash on exit when multiple signals are received - Fix conversion of very small floating-point numbers in command packets
Patchnames
HPE-Helion-OpenStack-8-2021-4147,SUSE-2021-4147,SUSE-OpenStack-Cloud-8-2021-4147,SUSE-OpenStack-Cloud-9-2021-4147,SUSE-OpenStack-Cloud-Crowbar-8-2021-4147,SUSE-OpenStack-Cloud-Crowbar-9-2021-4147,SUSE-SLE-SAP-12-SP3-2021-4147,SUSE-SLE-SAP-12-SP4-2021-4147,SUSE-SLE-SERVER-12-SP2-BCL-2021-4147,SUSE-SLE-SERVER-12-SP3-2021-4147,SUSE-SLE-SERVER-12-SP3-BCL-2021-4147,SUSE-SLE-SERVER-12-SP4-LTSS-2021-4147,SUSE-SLE-SERVER-12-SP5-2021-4147
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for chrony",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for chrony fixes the following issues:\n\nChrony was updated to 4.1:\n\n* Add support for NTS servers specified by IP address (matching\n  Subject Alternative Name in server certificate)\n* Add source-specific configuration of trusted certificates\n* Allow multiple files and directories with trusted certificates\n* Allow multiple pairs of server keys and certificates\n* Add copy option to server/pool directive\n* Increase PPS lock limit to 40% of pulse interval\n* Perform source selection immediately after loading dump files\n* Reload dump files for addresses negotiated by NTS-KE server\n* Update seccomp filter and add less restrictive level\n* Restart ongoing name resolution on online command\n* Fix dump files to not include uncorrected offset\n* Fix initstepslew to accept time from own NTP clients\n* Reset NTP address and port when no longer negotiated by NTS-KE\n  server\n- Update clknetsim to snapshot f89702d.\n\n- Ensure the correct pool packages are installed for openSUSE and SLE (bsc#1180689).\n\n- Enable syscallfilter unconditionally (bsc#1181826).\n\nChrony was updated to 4.0:\n\nEnhancements\n\n- Add support for Network Time Security (NTS) authentication\n- Add support for AES-CMAC keys (AES128, AES256) with Nettle\n- Add authselectmode directive to control selection of\n  unauthenticated sources\n- Add binddevice, bindacqdevice, bindcmddevice directives\n- Add confdir directive to better support fragmented\n  configuration\n- Add sourcedir directive and \u0027reload sources\u0027 command to\n  support dynamic NTP sources specified in files\n- Add clockprecision directive\n- Add dscp directive to set Differentiated Services Code Point\n  (DSCP)\n- Add -L option to limit log messages by severity\n- Add -p option to print whole configuration with included\n  files\n- Add -U option to allow start under non-root user\n- Allow maxsamples to be set to 1 for faster update with -q/-Q\n  option\n- Avoid replacing NTP sources with sources that have\n  unreachable address\n- Improve pools to repeat name resolution to get \u0027maxsources\u0027\n  sources\n- Improve source selection with trusted sources\n- Improve NTP loop test to prevent synchronisation to itself\n- Repeat iburst when NTP source is switched from offline state\n  to online\n- Update clock synchronisation status and leap status more\n  frequently\n- Update seccomp filter\n- Add \u0027add pool\u0027 command\n- Add \u0027reset sources\u0027 command to drop all measurements\n- Add authdata command to print details about NTP\n  authentication\n- Add selectdata command to print details about source\n  selection\n- Add -N option and sourcename command to print original names\n  of sources\n- Add -a option to some commands to print also unresolved\n  sources\n- Add -k, -p, -r options to clients command to select, limit,\n  reset data\n- Bug fixes\n- Don\u2019t set interface for NTP responses to allow asymmetric\n  routing\n- Handle RTCs that don\u2019t support interrupts\n- Respond to command requests with correct address on\n  multihomed hosts\n- Removed features\n- Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320)\n- Drop support for long (non-standard) MACs in NTPv4 packets\n  (chrony 2.x clients using non-MD5/SHA1 keys need to use\n  option \u0027version 3\u0027)\n\n- By default we don\u0027t write log files but log to journald, so\n  only recommend logrotate.\n\n- Adjust and rename the sysconfig file, so that it matches the\n  expectations of chronyd.service (bsc#1173277).\n\nChrony was updated to 3.5.1:\n\n* Create new file when writing pidfile (CVE-2020-14367, bsc#1174911)\n\n- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that\n  preconfigure chrony to use NTP servers from the  respective\n  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).\n- Add chrony-pool-empty to still allow installing chrony without\n  preconfigured servers.\n- Use iburst in the default pool statements to speed up initial\n  synchronisation (bsc#1172113).\n\n- Update clknetsim to version 79ffe44 (fixes bsc#1162964).\n\nUpdate to 3.5:\n\n+ Add support for more accurate reading of PHC on Linux 5.0\n+ Add support for hardware timestamping on interfaces with read-only timestamping configuration\n+ Add support for memory locking and real-time priority on FreeBSD, NetBSD, Solaris\n+ Update seccomp filter to work on more architectures\n+ Validate refclock driver options\n+ Fix bindaddress directive on FreeBSD\n+ Fix transposition of hardware RX timestamp on Linux 4.13 and later\n+ Fix building on non-glibc systems\n\n- Fix location of helper script in chrony-dnssrv@.service (bsc#1128846).\n\n- Read runtime servers from /var/run/netconfig/chrony.servers (bsc#1099272)\n- Move chrony-helper to /usr/lib/chrony/helper, because there should be no executables in /usr/share.\n- Remove discrepancies between spec file and chrony-tmpfiles (bsc#1115529) \n\nUpdate to version 3.4\n\n* Enhancements\n\n  + Add filter option to server/pool/peer directive\n  + Add minsamples and maxsamples options to hwtimestamp directive\n  + Add support for faster frequency adjustments in Linux 4.19\n  + Change default pidfile to /var/run/chrony/chronyd.pid to allow chronyd \n    without root privileges to remove it on exit\n  + Disable sub-second polling intervals for distant NTP sources\n  + Extend range of supported sub-second polling intervals\n  + Get/set IPv4 destination/source address of NTP packets on FreeBSD\n  + Make burst options and command useful with short polling intervals\n  + Modify auto_offline option to activate when sending request failed\n  + Respond from interface that received NTP request if possible\n  + Add onoffline command to switch between online and offline state \n    according to current system network configuration\n  + Improve example NetworkManager dispatcher script\n\n* Bug fixes\n\n  + Avoid waiting in Linux getrandom system call\n  + Fix PPS support on FreeBSD and NetBSD\n\nUpdate to version 3.3\n\n* Enhancements:\n\n  + Add burst option to server/pool directive\n  + Add stratum and tai options to refclock directive\n  + Add support for Nettle crypto library\n  + Add workaround for missing kernel receive timestamps on Linux\n  + Wait for late hardware transmit timestamps\n  + Improve source selection with unreachable sources\n  + Improve protection against replay attacks on symmetric mode\n  + Allow PHC refclock to use socket in /var/run/chrony\n  + Add shutdown command to stop chronyd\n  + Simplify format of response to manual list command\n  + Improve handling of unknown responses in chronyc\n\n* Bug fixes:\n\n  + Respond to NTPv1 client requests with zero mode\n  + Fix -x option to not require CAP_SYS_TIME under non-root user\n  + Fix acquisitionport directive to work with privilege separation\n  + Fix handling of socket errors on Linux to avoid high CPU usage\n  + Fix chronyc to not get stuck in infinite loop after clock step\n\n- Added /etc/chrony.d/ directory to the package (bsc#1083597) Modifed default chrony.conf to add \u0027include /etc/chrony.d/*\u0027\n\n- Enable pps support\n\nUpgraded to version 3.2:\n\nEnhancements\n\n* Improve stability with NTP sources and reference clocks\n* Improve stability with hardware timestamping\n* Improve support for NTP interleaved modes\n* Control frequency of system clock on macOS 10.13 and later\n* Set TAI-UTC offset of system clock with leapsectz directive\n* Minimise data in client requests to improve privacy\n* Allow transmit-only hardware timestamping\n* Add support for new timestamping options introduced in Linux 4.13\n* Add root delay, root dispersion and maximum error to tracking log\n* Add mindelay and asymmetry options to server/peer/pool directive\n* Add extpps option to PHC refclock to timestamp external PPS signal\n* Add pps option to refclock directive to treat any refclock as PPS\n* Add width option to refclock directive to filter wrong pulse edges\n* Add rxfilter option to hwtimestamp directive\n* Add -x option to disable control of system clock\n* Add -l option to log to specified file instead of syslog\n* Allow multiple command-line options to be specified together\n* Allow starting without root privileges with -Q option\n* Update seccomp filter for new glibc versions\n* Dump history on exit by default with dumpdir directive\n* Use hardening compiler options by default\n\nBug fixes\n\n* Don\u0027t drop PHC samples with low-resolution system clock\n* Ignore outliers in PHC tracking, RTC tracking, manual input\n* Increase polling interval when peer is not responding\n* Exit with error message when include directive fails\n* Don\u0027t allow slash after hostname in allow/deny directive/command\n* Try to connect to all addresses in chronyc before giving up\n\nUpgraded to version 3.1:\n\n- Enhancements\n\n  - Add support for precise cross timestamping of PHC on Linux\n  - Add minpoll, precision, nocrossts options to hwtimestamp directive\n  - Add rawmeasurements option to log directive and modify measurements\n    option to log only valid measurements from synchronised sources\n  - Allow sub-second polling interval with NTP sources\n\n- Bug fixes\n\n  - Fix time smoothing in interleaved mode\n\nUpgraded to version 3.0:\n\n- Enhancements\n\n  - Add support for software and hardware timestamping on Linux\n  - Add support for client/server and symmetric interleaved modes\n  - Add support for MS-SNTP authentication in Samba\n  - Add support for truncated MACs in NTPv4 packets\n  - Estimate and correct for asymmetric network jitter\n  - Increase default minsamples and polltarget to improve stability with very low jitter\n  - Add maxjitter directive to limit source selection by jitter\n  - Add offset option to server/pool/peer directive\n  - Add maxlockage option to refclock directive\n  - Add -t option to chronyd to exit after specified time\n  - Add partial protection against replay attacks on symmetric mode\n  - Don\u0027t reset polling interval when switching sources to online state\n  - Allow rate limiting with very short intervals\n  - Improve maximum server throughput on Linux and NetBSD\n  - Remove dump files after start\n  - Add tab-completion to chronyc with libedit/readline\n  - Add ntpdata command to print details about NTP measurements\n  - Allow all source options to be set in add server/peer command\n  - Indicate truncated addresses/hostnames in chronyc output\n  - Print reference IDs as hexadecimal numbers to avoid confusion with IPv4 addresses\n\n- Bug fixes\n\n  - Fix crash with disabled asynchronous name resolving\n\nUpgraded to version 2.4.1:\n\n- Bug fixes\n\n  - Fix processing of kernel timestamps on non-Linux systems\n  - Fix crash with smoothtime directive\n  - Fix validation of refclock sample times\n  - Fix parsing of refclock directive\n\nupdate to 2.4:\n\n- Enhancements\n\n  - Add orphan option to local directive for orphan mode\n    compatible with ntpd\n  - Add distance option to local directive to set activation\n    threshold (1 second by default)\n  - Add maxdrift directive to set maximum allowed drift of system\n    clock\n  - Try to replace NTP sources exceeding maximum distance\n  - Randomise source replacement to avoid getting stuck with bad\n    sources\n  - Randomise selection of sources from pools on start\n  - Ignore reference timestamp as ntpd doesn\u0027t always set it\n    correctly\n  - Modify tracking report to use same values as seen by NTP\n    clients\n  - Add -c option to chronyc to write reports in CSV format\n  - Provide detailed manual pages\n\n- Bug fixes\n\n  - Fix SOCK refclock to work correctly when not specified as\n    last refclock\n  - Fix initstepslew and -q/-Q options to accept time from own\n    NTP clients\n  - Fix authentication with keys using 512-bit hash functions\n  - Fix crash on exit when multiple signals are received\n  - Fix conversion of very small floating-point numbers in\n    command packets\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "HPE-Helion-OpenStack-8-2021-4147,SUSE-2021-4147,SUSE-OpenStack-Cloud-8-2021-4147,SUSE-OpenStack-Cloud-9-2021-4147,SUSE-OpenStack-Cloud-Crowbar-8-2021-4147,SUSE-OpenStack-Cloud-Crowbar-9-2021-4147,SUSE-SLE-SAP-12-SP3-2021-4147,SUSE-SLE-SAP-12-SP4-2021-4147,SUSE-SLE-SERVER-12-SP2-BCL-2021-4147,SUSE-SLE-SERVER-12-SP3-2021-4147,SUSE-SLE-SERVER-12-SP3-BCL-2021-4147,SUSE-SLE-SERVER-12-SP4-LTSS-2021-4147,SUSE-SLE-SERVER-12-SP5-2021-4147",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2021_4147-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2021:4147-1",
        "url": "https://www.suse.com/support/update/announcement/2021/suse-su-20214147-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2021:4147-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-December/009931.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1063704",
        "url": "https://bugzilla.suse.com/1063704"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1069468",
        "url": "https://bugzilla.suse.com/1069468"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1082318",
        "url": "https://bugzilla.suse.com/1082318"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1083597",
        "url": "https://bugzilla.suse.com/1083597"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1099272",
        "url": "https://bugzilla.suse.com/1099272"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1115529",
        "url": "https://bugzilla.suse.com/1115529"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1128846",
        "url": "https://bugzilla.suse.com/1128846"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1156884",
        "url": "https://bugzilla.suse.com/1156884"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1159840",
        "url": "https://bugzilla.suse.com/1159840"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1161119",
        "url": "https://bugzilla.suse.com/1161119"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1162964",
        "url": "https://bugzilla.suse.com/1162964"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1171806",
        "url": "https://bugzilla.suse.com/1171806"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1172113",
        "url": "https://bugzilla.suse.com/1172113"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1173277",
        "url": "https://bugzilla.suse.com/1173277"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1173760",
        "url": "https://bugzilla.suse.com/1173760"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1174075",
        "url": "https://bugzilla.suse.com/1174075"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1174911",
        "url": "https://bugzilla.suse.com/1174911"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1180689",
        "url": "https://bugzilla.suse.com/1180689"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1181826",
        "url": "https://bugzilla.suse.com/1181826"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1183783",
        "url": "https://bugzilla.suse.com/1183783"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1184400",
        "url": "https://bugzilla.suse.com/1184400"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1187906",
        "url": "https://bugzilla.suse.com/1187906"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1190926",
        "url": "https://bugzilla.suse.com/1190926"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-14367 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-14367/"
      }
    ],
    "title": "Security update for chrony",
    "tracking": {
      "current_release_date": "2021-12-22T08:24:51Z",
      "generator": {
        "date": "2021-12-22T08:24:51Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2021:4147-1",
      "initial_release_date": "2021-12-22T08:24:51Z",
      "revision_history": [
        {
          "date": "2021-12-22T08:24:51Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "chrony-4.1-5.9.1.aarch64",
                "product": {
                  "name": "chrony-4.1-5.9.1.aarch64",
                  "product_id": "chrony-4.1-5.9.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "chrony-4.1-5.9.1.i586",
                "product": {
                  "name": "chrony-4.1-5.9.1.i586",
                  "product_id": "chrony-4.1-5.9.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "chrony-4.1-5.9.1.ppc64le",
                "product": {
                  "name": "chrony-4.1-5.9.1.ppc64le",
                  "product_id": "chrony-4.1-5.9.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "chrony-4.1-5.9.1.s390",
                "product": {
                  "name": "chrony-4.1-5.9.1.s390",
                  "product_id": "chrony-4.1-5.9.1.s390"
                }
              }
            ],
            "category": "architecture",
            "name": "s390"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "chrony-4.1-5.9.1.s390x",
                "product": {
                  "name": "chrony-4.1-5.9.1.s390x",
                  "product_id": "chrony-4.1-5.9.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "chrony-4.1-5.9.1.x86_64",
                "product": {
                  "name": "chrony-4.1-5.9.1.x86_64",
                  "product_id": "chrony-4.1-5.9.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "HPE Helion OpenStack 8",
                "product": {
                  "name": "HPE Helion OpenStack 8",
                  "product_id": "HPE Helion OpenStack 8",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:hpe-helion-openstack:8"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE OpenStack Cloud 8",
                "product": {
                  "name": "SUSE OpenStack Cloud 8",
                  "product_id": "SUSE OpenStack Cloud 8",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-openstack-cloud:8"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE OpenStack Cloud 9",
                "product": {
                  "name": "SUSE OpenStack Cloud 9",
                  "product_id": "SUSE OpenStack Cloud 9",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-openstack-cloud:9"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE OpenStack Cloud Crowbar 8",
                "product": {
                  "name": "SUSE OpenStack Cloud Crowbar 8",
                  "product_id": "SUSE OpenStack Cloud Crowbar 8",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-openstack-cloud-crowbar:8"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE OpenStack Cloud Crowbar 9",
                "product": {
                  "name": "SUSE OpenStack Cloud Crowbar 9",
                  "product_id": "SUSE OpenStack Cloud Crowbar 9",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-openstack-cloud-crowbar:9"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP2-BCL",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP2-BCL",
                  "product_id": "SUSE Linux Enterprise Server 12 SP2-BCL",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-bcl:12:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP3-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP3-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:12:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP3-BCL",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP3-BCL",
                  "product_id": "SUSE Linux Enterprise Server 12 SP3-BCL",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-bcl:12:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP4-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP4-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:12:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:12:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.x86_64 as component of HPE Helion OpenStack 8",
          "product_id": "HPE Helion OpenStack 8:chrony-4.1-5.9.1.x86_64"
        },
        "product_reference": "chrony-4.1-5.9.1.x86_64",
        "relates_to_product_reference": "HPE Helion OpenStack 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.x86_64 as component of SUSE OpenStack Cloud 8",
          "product_id": "SUSE OpenStack Cloud 8:chrony-4.1-5.9.1.x86_64"
        },
        "product_reference": "chrony-4.1-5.9.1.x86_64",
        "relates_to_product_reference": "SUSE OpenStack Cloud 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.x86_64 as component of SUSE OpenStack Cloud 9",
          "product_id": "SUSE OpenStack Cloud 9:chrony-4.1-5.9.1.x86_64"
        },
        "product_reference": "chrony-4.1-5.9.1.x86_64",
        "relates_to_product_reference": "SUSE OpenStack Cloud 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.x86_64 as component of SUSE OpenStack Cloud Crowbar 8",
          "product_id": "SUSE OpenStack Cloud Crowbar 8:chrony-4.1-5.9.1.x86_64"
        },
        "product_reference": "chrony-4.1-5.9.1.x86_64",
        "relates_to_product_reference": "SUSE OpenStack Cloud Crowbar 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.x86_64 as component of SUSE OpenStack Cloud Crowbar 9",
          "product_id": "SUSE OpenStack Cloud Crowbar 9:chrony-4.1-5.9.1.x86_64"
        },
        "product_reference": "chrony-4.1-5.9.1.x86_64",
        "relates_to_product_reference": "SUSE OpenStack Cloud Crowbar 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:chrony-4.1-5.9.1.ppc64le"
        },
        "product_reference": "chrony-4.1-5.9.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:chrony-4.1-5.9.1.x86_64"
        },
        "product_reference": "chrony-4.1-5.9.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:chrony-4.1-5.9.1.ppc64le"
        },
        "product_reference": "chrony-4.1-5.9.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:chrony-4.1-5.9.1.x86_64"
        },
        "product_reference": "chrony-4.1-5.9.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2-BCL",
          "product_id": "SUSE Linux Enterprise Server 12 SP2-BCL:chrony-4.1-5.9.1.x86_64"
        },
        "product_reference": "chrony-4.1-5.9.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-BCL"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS:chrony-4.1-5.9.1.aarch64"
        },
        "product_reference": "chrony-4.1-5.9.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS:chrony-4.1-5.9.1.ppc64le"
        },
        "product_reference": "chrony-4.1-5.9.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.s390x as component of SUSE Linux Enterprise Server 12 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS:chrony-4.1-5.9.1.s390x"
        },
        "product_reference": "chrony-4.1-5.9.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS:chrony-4.1-5.9.1.x86_64"
        },
        "product_reference": "chrony-4.1-5.9.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP3-BCL",
          "product_id": "SUSE Linux Enterprise Server 12 SP3-BCL:chrony-4.1-5.9.1.x86_64"
        },
        "product_reference": "chrony-4.1-5.9.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-BCL"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:chrony-4.1-5.9.1.aarch64"
        },
        "product_reference": "chrony-4.1-5.9.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:chrony-4.1-5.9.1.ppc64le"
        },
        "product_reference": "chrony-4.1-5.9.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.s390x as component of SUSE Linux Enterprise Server 12 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:chrony-4.1-5.9.1.s390x"
        },
        "product_reference": "chrony-4.1-5.9.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:chrony-4.1-5.9.1.x86_64"
        },
        "product_reference": "chrony-4.1-5.9.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:chrony-4.1-5.9.1.aarch64"
        },
        "product_reference": "chrony-4.1-5.9.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:chrony-4.1-5.9.1.ppc64le"
        },
        "product_reference": "chrony-4.1-5.9.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.s390x as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:chrony-4.1-5.9.1.s390x"
        },
        "product_reference": "chrony-4.1-5.9.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:chrony-4.1-5.9.1.x86_64"
        },
        "product_reference": "chrony-4.1-5.9.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:chrony-4.1-5.9.1.aarch64"
        },
        "product_reference": "chrony-4.1-5.9.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:chrony-4.1-5.9.1.ppc64le"
        },
        "product_reference": "chrony-4.1-5.9.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:chrony-4.1-5.9.1.s390x"
        },
        "product_reference": "chrony-4.1-5.9.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chrony-4.1-5.9.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:chrony-4.1-5.9.1.x86_64"
        },
        "product_reference": "chrony-4.1-5.9.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-14367",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-14367"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder. The file is created during chronyd startup while still running as the root user, and when it\u0027s opened for writing, chronyd does not check for an existing symbolic link with the same file name. This flaw allows an attacker with privileged access to create a symlink with the default PID file name pointing to any destination file in the system, resulting in data loss and a denial of service due to the path traversal.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "HPE Helion OpenStack 8:chrony-4.1-5.9.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2-BCL:chrony-4.1-5.9.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP3-BCL:chrony-4.1-5.9.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP3-LTSS:chrony-4.1-5.9.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP3-LTSS:chrony-4.1-5.9.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP3-LTSS:chrony-4.1-5.9.1.s390x",
          "SUSE Linux Enterprise Server 12 SP3-LTSS:chrony-4.1-5.9.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4-LTSS:chrony-4.1-5.9.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP4-LTSS:chrony-4.1-5.9.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP4-LTSS:chrony-4.1-5.9.1.s390x",
          "SUSE Linux Enterprise Server 12 SP4-LTSS:chrony-4.1-5.9.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:chrony-4.1-5.9.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP5:chrony-4.1-5.9.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP5:chrony-4.1-5.9.1.s390x",
          "SUSE Linux Enterprise Server 12 SP5:chrony-4.1-5.9.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:chrony-4.1-5.9.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:chrony-4.1-5.9.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:chrony-4.1-5.9.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:chrony-4.1-5.9.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:chrony-4.1-5.9.1.aarch64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:chrony-4.1-5.9.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:chrony-4.1-5.9.1.s390x",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:chrony-4.1-5.9.1.x86_64",
          "SUSE OpenStack Cloud 8:chrony-4.1-5.9.1.x86_64",
          "SUSE OpenStack Cloud 9:chrony-4.1-5.9.1.x86_64",
          "SUSE OpenStack Cloud Crowbar 8:chrony-4.1-5.9.1.x86_64",
          "SUSE OpenStack Cloud Crowbar 9:chrony-4.1-5.9.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-14367",
          "url": "https://www.suse.com/security/cve/CVE-2020-14367"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1174911 for CVE-2020-14367",
          "url": "https://bugzilla.suse.com/1174911"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "HPE Helion OpenStack 8:chrony-4.1-5.9.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-BCL:chrony-4.1-5.9.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP3-BCL:chrony-4.1-5.9.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP3-LTSS:chrony-4.1-5.9.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP3-LTSS:chrony-4.1-5.9.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP3-LTSS:chrony-4.1-5.9.1.s390x",
            "SUSE Linux Enterprise Server 12 SP3-LTSS:chrony-4.1-5.9.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4-LTSS:chrony-4.1-5.9.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP4-LTSS:chrony-4.1-5.9.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP4-LTSS:chrony-4.1-5.9.1.s390x",
            "SUSE Linux Enterprise Server 12 SP4-LTSS:chrony-4.1-5.9.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:chrony-4.1-5.9.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5:chrony-4.1-5.9.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5:chrony-4.1-5.9.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5:chrony-4.1-5.9.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:chrony-4.1-5.9.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:chrony-4.1-5.9.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:chrony-4.1-5.9.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:chrony-4.1-5.9.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:chrony-4.1-5.9.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:chrony-4.1-5.9.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:chrony-4.1-5.9.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:chrony-4.1-5.9.1.x86_64",
            "SUSE OpenStack Cloud 8:chrony-4.1-5.9.1.x86_64",
            "SUSE OpenStack Cloud 9:chrony-4.1-5.9.1.x86_64",
            "SUSE OpenStack Cloud Crowbar 8:chrony-4.1-5.9.1.x86_64",
            "SUSE OpenStack Cloud Crowbar 9:chrony-4.1-5.9.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "HPE Helion OpenStack 8:chrony-4.1-5.9.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-BCL:chrony-4.1-5.9.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP3-BCL:chrony-4.1-5.9.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP3-LTSS:chrony-4.1-5.9.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP3-LTSS:chrony-4.1-5.9.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP3-LTSS:chrony-4.1-5.9.1.s390x",
            "SUSE Linux Enterprise Server 12 SP3-LTSS:chrony-4.1-5.9.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4-LTSS:chrony-4.1-5.9.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP4-LTSS:chrony-4.1-5.9.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP4-LTSS:chrony-4.1-5.9.1.s390x",
            "SUSE Linux Enterprise Server 12 SP4-LTSS:chrony-4.1-5.9.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:chrony-4.1-5.9.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5:chrony-4.1-5.9.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5:chrony-4.1-5.9.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5:chrony-4.1-5.9.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:chrony-4.1-5.9.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:chrony-4.1-5.9.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:chrony-4.1-5.9.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:chrony-4.1-5.9.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:chrony-4.1-5.9.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:chrony-4.1-5.9.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:chrony-4.1-5.9.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:chrony-4.1-5.9.1.x86_64",
            "SUSE OpenStack Cloud 8:chrony-4.1-5.9.1.x86_64",
            "SUSE OpenStack Cloud 9:chrony-4.1-5.9.1.x86_64",
            "SUSE OpenStack Cloud Crowbar 8:chrony-4.1-5.9.1.x86_64",
            "SUSE OpenStack Cloud Crowbar 9:chrony-4.1-5.9.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-12-22T08:24:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-14367"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.