What is CVE-2016-1567?

CVE-2016-1567 is a high-severity vulnerability in Tuxfamily Chrony, classified under CWE-254. CVSS score: 8.1/10. Published 2016-01-26.

How severe is CVE-2016-1567?

High severity. CVSS v3 base score is 8.1 out of 10.

Vulnerability in Tuxfamily Chrony

CVE-2016-1567

chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."

EPSS: 0.026 (84.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Tuxfamily Chrony — versions 2.0, 2.1, 2.1.1
N/a — versions n/a

Weakness classification (CWE)

CWE-254

References

cve@mitre.org (Exploit, x_refsource_MISC)
cve@mitre.org (vendor-advisory, x_refsource_FEDORA)
cve@mitre.org (vendor-advisory, x_refsource_FEDORA, Patch)
cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2016-1567?: CVE-2016-1567 is a high-severity vulnerability in Tuxfamily Chrony, classified under CWE-254. CVSS score: 8.1/10. Published 2016-01-26.
How severe is CVE-2016-1567?: High severity. CVSS v3 base score is 8.1 out of 10.