Source: openntpd Version: 1:5.7p4-4 Severity: normal Tags: security upstream patch
Hi, the following vulnerability was published for openntpd. CVE-2016-5117[0]: OpenNTPD not verifying CN during HTTPS constraints request As far I can tell we though are not affected in default Debian installations, since constraints not enabled. The source seems though affected, so this bug is to track the issue. Let me know though if I'm wrong here. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2016-5117 [1] http://www.openwall.com/lists/oss-security/2016/05/23/2 [2] http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/ntpd/constraint.c.diff?r1=1.27&r2=1.28 Regards, Salvatore