CVE-2021-22212

ntpkeygen can generate keys that ntpd fails to parse. NTPsec 1.2.0 allows ntpkeygen to generate keys with '#' characters. ntpd then either pads, shortens the key, or fails to load these keys entirely, depending on the key type and the placement of the '#'. This results in the administrator not being able to use the keys as expected or the keys are shorter than expected and easier to brute-force, possibly resulting in MITM attacks between ntp clients and ntp servers. For short AES128 keys, ntpd generates a warning that it is padding them.

• CWE-327

• https://bugzilla.redhat.com/show_bug.cgi?id=1955859Issue Tracking, Patch, Third Party Advisory
• https://gitlab.com/NTPsec/ntpsec/-/issues/699Issue Tracking, Patch, Third Party Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22212.jsonThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3GIT2HYL5BQXPGKI6ZDNG473IEQ5WQF2/
• https://bugzilla.redhat.com/show_bug.cgi?id=1955859Issue Tracking, Patch, Third Party Advisory
• https://gitlab.com/NTPsec/ntpsec/-/issues/699Issue Tracking, Patch, Third Party Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22212.jsonThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3GIT2HYL5BQXPGKI6ZDNG473IEQ5WQF2/

Published

Jun 8, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-22207Excessive memory consumption in MS-WSP dissector in Wireshar…6.5
• CVE-2021-22208An issue has been discovered in GitLab affecting versions st…4.3
• CVE-2021-22209An issue has been discovered in GitLab CE/EE affecting all v…7.5
• CVE-2021-2221Vulnerability in the Oracle Secure Global Desktop product of…9.6
• CVE-2021-22210An issue has been discovered in GitLab CE/EE affecting all v…5.3
• CVE-2021-22211An issue has been discovered in GitLab CE/EE affecting all v…4.3
• CVE-2021-22213A cross-site leak vulnerability in the OAuth flow of all ver…6.5
• CVE-2021-22214When requests to the internal network for webhooks are enabl…8.6
• CVE-2021-22215An information disclosure vulnerability in GitLab EE version…2.7
• CVE-2021-22216A denial of service vulnerability in all versions of GitLab …6.5
• CVE-2021-22217A denial of service vulnerability in all versions of GitLab …6.5
• CVE-2021-22218All versions of GitLab CE/EE starting from 12.8 before 13.10…2.6