CVE-2019-8936

Requires security backport for Bionic only.

Thanks for the debdiff - I am happy to sponsor this for you - one quick thing, there is no need to reference the debian bug report in the changelog so I have cleaned it up to look like the following:

ntp (1:4.2.8p10+dfsg-5ubuntu7.3) bionic-security; urgency=medium

  * SECURITY UPDATE: Null dereference attack in mode 6 packet (LP: #1891953)
    - debian/patches/CVE-2019-8936.patch: Guard against operations
      on NULL pointer in ntpd/ntp_control.c.
    - CVE-2019-8936

 -- Brian Morton <email address hidden> Mon, 17 Aug 2020 21:58:51 -0400

I also notice this CVE is also unresolved in focal and groovy - would you be interested in preparing debdiff's against ntp in those releases as well?

Hi Alex, thanks very much for fixing that loose end in the changelog and for sponsoring this fix. I can produce them for the other releases as well.

This bug was fixed in the package ntp - 1:4.2.8p10+dfsg-5ubuntu7.3

---------------
ntp (1:4.2.8p10+dfsg-5ubuntu7.3) bionic-security; urgency=medium

  * SECURITY UPDATE: Null dereference attack in mode 6 packet (LP: #1891953)
    - debian/patches/CVE-2019-8936.patch: Guard against operations
      on NULL pointer in ntpd/ntp_control.c.
    - CVE-2019-8936

 -- Brian Morton <email address hidden> Mon, 17 Aug 2020 21:58:51 -0400

@rokclimb15 - are you still looking at producing debdiff's for focal + groovy as well?

@alexmurray - Yes, I'll work on it this week.

Excellent - thank you :)

Patch for Focal

@alexmurray - The debdiff for Groovy is identical to the one from Focal (same source package version). Let me know if you need a distinct debdiff with the release pocket (groovy-security) identified.

Apologies for the delay on this, it fell off our radar but we're working on the Focal+ updates now. And no need for the separate Groovy debdiff, thanks Brian!

This bug was fixed in the package ntp - 1:4.2.8p12+dfsg-3ubuntu4.20.10.1

---------------
ntp (1:4.2.8p12+dfsg-3ubuntu4.20.10.1) groovy-security; urgency=medium

  * SECURITY UPDATE: Null dereference attack in mode 6 packet (LP: #1891953)
    - debian/patches/CVE-2019-8936.patch: Guard against operations
      on NULL pointer in ntpd/ntp_control.c.
    - CVE-2019-8936
  * Fix FTBFS with GCC-10
    - debian/rules: add -fcommon flag to CFLAGS

 -- Brian Morton <email address hidden> Fri, 27 Nov 2020 16:10:51 -0500

This bug was fixed in the package ntp - 1:4.2.8p12+dfsg-3ubuntu4.20.04.1

---------------
ntp (1:4.2.8p12+dfsg-3ubuntu4.20.04.1) focal-security; urgency=medium

  * SECURITY UPDATE: Null dereference attack in mode 6 packet (LP: #1891953)
    - debian/patches/CVE-2019-8936.patch: Guard against operations
      on NULL pointer in ntpd/ntp_control.c.
    - CVE-2019-8936

 -- Brian Morton <email address hidden> Fri, 27 Nov 2020 16:10:51 -0500