diff -Nru ntp-4.2.8p10+dfsg/debian/changelog ntp-4.2.8p10+dfsg/debian/changelog --- ntp-4.2.8p10+dfsg/debian/changelog 2018-07-06 19:08:42.000000000 +0000 +++ ntp-4.2.8p10+dfsg/debian/changelog 2020-07-09 21:11:52.000000000 +0000 @@ -1,3 +1,10 @@ +ntp (1:4.2.8p10+dfsg-5ubuntu7.2) bionic; urgency=medium + + * ntpq should check return code from libcrypto calls (LP:1884265) + - debian/patches/ntpq-openssl-check.patch + + -- Joy Latten Thu, 09 Jul 2020 21:11:52 +0000 + ntp (1:4.2.8p10+dfsg-5ubuntu7.1) bionic-security; urgency=medium * SECURITY UPDATE: DoS via mode 6 packet diff -Nru ntp-4.2.8p10+dfsg/debian/patches/ntpq-openssl-check.patch ntp-4.2.8p10+dfsg/debian/patches/ntpq-openssl-check.patch --- ntp-4.2.8p10+dfsg/debian/patches/ntpq-openssl-check.patch 1970-01-01 00:00:00.000000000 +0000 +++ ntp-4.2.8p10+dfsg/debian/patches/ntpq-openssl-check.patch 2020-07-09 21:11:43.000000000 +0000 @@ -0,0 +1,26 @@ +From: Joy Latten +Forwarded: not-needed +Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1884265 +Description: ntpq crashes using fips-openssl + +Index: ntp-4.2.8p10+dfsg/ntpq/ntpq.c +=================================================================== +--- ntp-4.2.8p10+dfsg.orig/ntpq/ntpq.c ++++ ntp-4.2.8p10+dfsg/ntpq/ntpq.c +@@ -3645,8 +3645,14 @@ static void list_md_fn(const EVP_MD *m, + */ + + ctx = EVP_MD_CTX_new(); +- EVP_DigestInit(ctx, EVP_get_digestbyname(name)); +- EVP_DigestFinal(ctx, digest, &digest_len); ++ if (EVP_DigestInit(ctx, EVP_get_digestbyname(name)) <= 0) { ++ EVP_MD_CTX_free(ctx); ++ return; ++ } ++ if (EVP_DigestFinal(ctx, digest, &digest_len) <= 0) { ++ EVP_MD_CTX_free(ctx); ++ return; ++ } + EVP_MD_CTX_free(ctx); + if (digest_len > (MAX_MAC_LEN - sizeof(keyid_t))) + return; diff -Nru ntp-4.2.8p10+dfsg/debian/patches/series ntp-4.2.8p10+dfsg/debian/patches/series --- ntp-4.2.8p10+dfsg/debian/patches/series 2018-07-06 19:01:20.000000000 +0000 +++ ntp-4.2.8p10+dfsg/debian/patches/series 2020-07-09 21:11:43.000000000 +0000 @@ -12,3 +12,4 @@ CVE-2018-7183.patch CVE-2018-7184.patch CVE-2018-7185.patch +ntpq-openssl-check.patch