{"id":"CVE-2023-33192","aliases":["GHSA-qwhm-h7v3-mrjx"],"url":"https://o3.security/vulnerability/CVE-2023-33192","summary":"Improper handling of NTS cookie length that could crash the ntpd-rs server","details":"### Impact\nntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the server expects. The server also crashes when it is not configured to handle NTS packets.\n\nntpd-rs running purely as an ntp client is not affected.\n\n### Patches\nThe issue was caused by improper slice indexing. The indexing operations were replaced by safer alternatives that do not crash the ntpd-rs server process but instead properly handle the error condition. A patch was released in version 0.3.3\n\n### Workarounds\nntpd-rs running purely as an ntp client is not affected. By default, ntpd-rs packages are not configured to run as a server.\n\nFor machines where serving the time is required, there is no known workaround. Users are recommended to upgrade ntpd-rs as soon as possible.\n\n### References\nhttps://github.com/pendulum-project/ntpd-rs/pull/752\n\nWe would like to thank @mlichvar for identifying this issue\n","published":"2023-05-27T03:53:34.506Z","modified":"2026-10-28T02:30:48.308267628Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"ntpd","fixedVersion":"0.3.3"}],"fix":{"url":"https://github.com/pendulum-project/ntpd-rs/pull/752","label":"pendulum-project/ntpd-rs#752"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33192.json"},{"type":"ADVISORY","url":"https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-qwhm-h7v3-mrjx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33192"},{"type":"FIX","url":"https://github.com/pendulum-project/ntpd-rs/pull/752"},{"type":"PACKAGE","url":"https://github.com/pendulum-project/ntpd-rs"},{"type":"WEB","url":"https://github.com/pendulum-project/ntpd-rs/releases/tag/v0.3.3"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:48.308267628Z"}}