CVE-2016-1567: chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authentica...

Security readout for executives and security teams

This flaw affects older chrony time-synchronization software. When symmetric-key authentication is used, chrony could accept packets authenticated with any trusted key rather than the specific key tied to that peer. An attacker with a trusted key could impersonate another time peer, potentially undermining trusted time on affected systems. Exposure is most likely on systems running vulnerable chrony versions with symmetric-key authenticated NTP relationships. Systems not using chrony, or using fixed versions, are not indicated as affected by the provided sources. Treat this as a targeted infrastructure integrity issue, not a broad internet-scale emergency based on current evidence. Prioritize servers where trusted time supports authentication, logging, certificates, audits, or operational sequencing. Mitigation focus: Upgrade chrony to 1.31.2, 2.2.1, or a later vendor-supported release.; Apply relevant operating-system package updates from Fedora or your distribution vendor.; Inventory chrony hosts using symmetric-key authentication..

Prepared

Jun 13, 2026, 21:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.