Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package ntpsec for openSUSE:Factory checked in at 2026-10-22 15:50:37 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/ntpsec (Old) and /work/SRC/openSUSE:Factory/.ntpsec.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "ntpsec" Thu Oct 22 15:50:37 2026 rev:26 rq:1386972 version:1.2.6 Changes: -------- --- /work/SRC/openSUSE:Factory/ntpsec/ntpsec.changes 2026-08-01 18:37:35.064879509 +0200 +++ /work/SRC/openSUSE:Factory/.ntpsec.new.2252680/ntpsec.changes 2026-10-22 15:54:29.453653053 +0200 @@ -1,0 +2,54 @@ +Wed Oct 21 19:00:18 UTC 2026 - Martin Hauke <[email protected]> + +- Update to version 1.2.6 + Changes + * Shared key authentication now supports HMAC mode. + * A shared key ID equal to the maximum key number is now accepted + in the configuration (NTPsec/ntpsec#896). + * The Trimble TSIP reference clock driver no longer announces an + imminent leap second weeks early whenever the receiver has a + leap correction queued. + * Fixed misaligned access to restriction list entries, which could + crash ntpd on strict-alignment platforms. + * ntpd now starts on systems whose OpenSSL providers don't offer + MD5, such as FIPS-only configurations. Keys whose algorithm + OpenSSL can't run are now skipped with a log message when the + keys file is read, instead of failing on every packet + (NTPsec/ntpsec#900). + Security Fixes: + * Fixed an out-of-bounds read in NTS server extension parsing + caused by an unchecked nonce length, which allowed a remote + attacker holding an NTS cookie to crash 'ntpd' + (CVE-2026-102486), (boo#1286631). + * Fixed a remotely triggerable exit in the NTS server when a + request carried more NTS Cookie Placeholders than fit in the + response (CVE-2026-102483), (boo#1286628) + * Fixed an out-of-bounds write in the JJY reference clock driver + when a Telephone JJY source sends more time replies than + expected (CVE-2026-102484), (boo#1286629) + * Fixed an out-of-bounds read in the Motorola Oncore reference + clock driver on a PPS Control reply with an out-of-range mode + byte (CVE-2026-102485), (boo#1286630) + NTS and NTS-KE Fixes: + * The NTS-KE server no longer treats unrecognized non-critical + records as critical, fixing interoperability with chrony + (NTPsec/ntpsec#892). + * The NTS-KE server now replies with an RFC 8915 Error record when + a request is malformed or the server cannot derive session keys, + rejects duplicate or missing Next Protocol and AEAD records, and + passes the ntske-test suite. + * The NTS server now rejects Unique Identifier extension fields + shorter than the 32 octets RFC 8915 requires. + * The NTS server now rejects NTS cookies shorter than the key ID + and nonce before parsing them. + * The NTS server now accepts requests with nonces longer than 16 + octets, shorter nonces with enough padding, and encrypted + extension fields, as RFC 8915 allows. + * The NTS-KE client now rejects responses that lack an End of + Message record. + * The NTS client now bounds the AEEF nonce length against the + bytes remaining in the packet. + * Fixed misaligned reads and writes of NTS-KE records, which could + crash ntpd on strict-alignment platforms. + +------------------------------------------------------------------- Old: ---- ntpsec-1.2.5.tar.gz ntpsec-1.2.5.tar.gz.asc New: ---- ntpsec-1.2.6.tar.gz ntpsec-1.2.6.tar.gz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ ntpsec.spec ++++++ --- /var/tmp/diff_new_pack.WB9qXi/_old 2026-10-22 15:54:30.396692582 +0200 +++ /var/tmp/diff_new_pack.WB9qXi/_new 2026-10-22 15:54:30.398692666 +0200 @@ -18,7 +18,7 @@ Name: ntpsec -Version: 1.2.5 +Version: 1.2.6 Release: 0 Summary: Improved implementation of Network Time Protocol License: BSD-2-Clause AND NTP AND BSD-3-Clause AND MIT ++++++ ntpsec-1.2.5.tar.gz -> ntpsec-1.2.6.tar.gz ++++++ ++++ 54370 lines of diff (skipped)
