{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "title": "Information Disclosure vulnerability via GET_RESTRICT control message",
    "tracking": {
      "current_release_date": "2026-08-11T14:01:36+00:00",
      "generator": {
        "date": "2026-08-11T14:01:36+00:00",
        "engine": {
          "name": "CSAF Generator",
          "version": "3.3.0"
        }
      },
      "id": "CVE-2014-5209",
      "initial_release_date": "2014-08-25T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2026-08-11T14:01:36+00:00",
          "number": "1",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Red Hat",
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 5.11",
            "product": {
              "name": "Red Hat Enterprise Linux 5.11",
              "product_id": "rhel-5.11.z.els",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:rhel_els:5"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 6-els",
            "product": {
              "name": "Red Hat Enterprise Linux 6-els",
              "product_id": "rhel-6-els.els",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:rhel_els:6"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 7-els",
            "product": {
              "name": "Red Hat Enterprise Linux 7-els",
              "product_id": "rhel-7-els.els",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:rhel_els:7"
              }
            }
          },
          {
            "category": "product_version",
            "name": "ntp",
            "product": {
              "name": "ntp",
              "product_id": "ntp",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/ntp"
              }
            }
          },
          {
            "category": "product_version",
            "name": "ntp-debuginfo",
            "product": {
              "name": "ntp-debuginfo",
              "product_id": "ntp-debuginfo",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/ntp-debuginfo"
              }
            }
          },
          {
            "category": "product_version",
            "name": "ntp-doc",
            "product": {
              "name": "ntp-doc",
              "product_id": "ntp-doc",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/ntp-doc"
              }
            }
          },
          {
            "category": "product_version",
            "name": "ntp-perl",
            "product": {
              "name": "ntp-perl",
              "product_id": "ntp-perl",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/ntp-perl"
              }
            }
          },
          {
            "category": "product_version",
            "name": "ntp",
            "product": {
              "name": "ntp",
              "product_id": "ntp.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/ntp?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "ntpdate",
            "product": {
              "name": "ntpdate",
              "product_id": "ntpdate",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/ntpdate"
              }
            }
          },
          {
            "category": "product_version",
            "name": "sntp",
            "product": {
              "name": "sntp",
              "product_id": "sntp",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/sntp"
              }
            }
          }
        ]
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ntp as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:ntp"
        },
        "product_reference": "ntp",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ntp as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:ntp"
        },
        "product_reference": "ntp",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ntp-debuginfo as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:ntp-debuginfo"
        },
        "product_reference": "ntp-debuginfo",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ntp-debuginfo as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:ntp-debuginfo"
        },
        "product_reference": "ntp-debuginfo",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ntp-doc as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:ntp-doc"
        },
        "product_reference": "ntp-doc",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ntp-doc as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:ntp-doc"
        },
        "product_reference": "ntp-doc",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ntp-perl as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:ntp-perl"
        },
        "product_reference": "ntp-perl",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ntp-perl as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:ntp-perl"
        },
        "product_reference": "ntp-perl",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ntp.src as a component of Red Hat Enterprise Linux 5.11",
          "product_id": "rhel-5.11.z.els:ntp.src"
        },
        "product_reference": "ntp.src",
        "relates_to_product_reference": "rhel-5.11.z.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ntp.src as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:ntp.src"
        },
        "product_reference": "ntp.src",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ntp.src as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:ntp.src"
        },
        "product_reference": "ntp.src",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ntpdate as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:ntpdate"
        },
        "product_reference": "ntpdate",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ntpdate as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:ntpdate"
        },
        "product_reference": "ntpdate",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sntp as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:sntp"
        },
        "product_reference": "sntp",
        "relates_to_product_reference": "rhel-7-els.els"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-5209",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2020-01-08T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "rhel-6-els.els:ntp-debuginfo",
            "rhel-6-els.els:ntp-doc",
            "rhel-7-els.els:ntp-debuginfo",
            "rhel-7-els.els:ntp-doc"
          ]
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "This issue did not affect the versions of ntp as shipped with Red Hat Enterprise Linux 5, 6, 7 in their default configurations. Red Hat Enterprise Linux uses the `restrict noquery` option by default, which denies ntpdc queries. No proper fix is available for this issue upstream, apart from disabling these kind of queries by default or denying them through the `restrict` access control command specified in /etc/ntp.conf. Users are adviced to use `noquery` in their configurations and allow them only from a trusted set of network addresses.",
          "title": "Statement"
        },
        {
          "category": "description",
          "text": "A flaw was discovered where an information disclosure is present in the Network Time Protocol (NTP) through the GET_RESTRICT control message, which can be sent with the reslist command of the ntpdc tool. An attacker can use this message to obtain sensitive information such as internal IP addresses and NTP’s configuration settings.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "known_affected": [
          "rhel-5.11.z.els:ntp.src",
          "rhel-6-els.els:ntp",
          "rhel-6-els.els:ntp-perl",
          "rhel-6-els.els:ntp.src",
          "rhel-6-els.els:ntpdate",
          "rhel-7-els.els:ntp",
          "rhel-7-els.els:ntp-perl",
          "rhel-7-els.els:ntp.src",
          "rhel-7-els.els:ntpdate",
          "rhel-7-els.els:sntp"
        ],
        "known_not_affected": [
          "rhel-6-els.els:ntp-debuginfo",
          "rhel-6-els.els:ntp-doc",
          "rhel-7-els.els:ntp-debuginfo",
          "rhel-7-els.els:ntp-doc"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-5209"
        },
        {
          "category": "external",
          "summary": "nvd.nist.gov",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-5209"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-5209"
        }
      ],
      "remediations": [
        {
          "category": "no_fix_planned",
          "details": "Will not fix",
          "product_ids": [
            "rhel-5.11.z.els:ntp.src",
            "rhel-6-els.els:ntp",
            "rhel-6-els.els:ntp-perl",
            "rhel-6-els.els:ntp.src",
            "rhel-6-els.els:ntpdate",
            "rhel-7-els.els:ntp",
            "rhel-7-els.els:ntp-perl",
            "rhel-7-els.els:ntp.src",
            "rhel-7-els.els:ntpdate",
            "rhel-7-els.els:sntp"
          ]
        },
        {
          "category": "workaround",
          "details": "If not already present, add `noquery` option to the `restrict` access control command specified in /etc/ntp.conf. Red Hat Enterprise Linux 7 is shipped by default with the following setting:\n\n   restrict default nomodify notrap nopeer noquery",
          "product_ids": [
            "rhel-5.11.z.els:ntp.src",
            "rhel-6-els.els:ntp",
            "rhel-6-els.els:ntp-perl",
            "rhel-6-els.els:ntp.src",
            "rhel-6-els.els:ntpdate",
            "rhel-7-els.els:ntp",
            "rhel-7-els.els:ntp-perl",
            "rhel-7-els.els:ntp.src",
            "rhel-7-els.els:ntpdate",
            "rhel-7-els.els:sntp"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM"
          },
          "products": [
            "rhel-5.11.z.els:ntp.src",
            "rhel-6-els.els:ntp",
            "rhel-6-els.els:ntp-debuginfo",
            "rhel-6-els.els:ntp-doc",
            "rhel-6-els.els:ntp-perl",
            "rhel-6-els.els:ntp.src",
            "rhel-6-els.els:ntpdate",
            "rhel-7-els.els:ntp",
            "rhel-7-els.els:ntp-debuginfo",
            "rhel-7-els.els:ntp-doc",
            "rhel-7-els.els:ntp-perl",
            "rhel-7-els.els:ntp.src",
            "rhel-7-els.els:ntpdate",
            "rhel-7-els.els:sntp"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low",
          "product_ids": [
            "rhel-5.11.z.els:ntp.src",
            "rhel-6-els.els:ntp",
            "rhel-6-els.els:ntp-debuginfo",
            "rhel-6-els.els:ntp-doc",
            "rhel-6-els.els:ntp-perl",
            "rhel-6-els.els:ntp.src",
            "rhel-6-els.els:ntpdate",
            "rhel-7-els.els:ntp",
            "rhel-7-els.els:ntp-debuginfo",
            "rhel-7-els.els:ntp-doc",
            "rhel-7-els.els:ntp-perl",
            "rhel-7-els.els:ntp.src",
            "rhel-7-els.els:ntpdate",
            "rhel-7-els.els:sntp"
          ]
        }
      ],
      "title": "Information Disclosure vulnerability via GET_RESTRICT control message"
    }
  ]
}