Intel

AIKIDO-2024-10114

github.com/beevik/ntp is vulnerable to Integer Overflow

Integer Overflow Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published Jun 4, 2024

20

Low Risk

This Affects:

gogithub.com/beevik/ntp
0.1.0 - 1.4.2
Fixed in 1.4.3
Are you affected? Scan for Free

TL;DR

Affected versions of the ntp package are vulnerable to an integer overflow in the calculation of the offset between client and server time.

Who does this affect?

You are affected if you are using a vulnerable version of the package, directly or indirecly in your application.

Background info

github.com/beevik/ntp is vulnerable to Integer Overflow in versions 0.1.0 - 1.4.2.

How to fix this

Upgrade github.com/beevik/ntp to the patch version (version 1.4.3).