CVE-2016-5117: OpenNTPD before 6.0p1 does not validate the CN for HTTPS constraint requests, which allows remote attackers...

Security readout for executives and security teams

OpenNTPD versions before 6.0p1 could accept an HTTPS constraint certificate without checking that the certificate name matched the expected host. This weakens a protection meant to stop time-source tampering. The main concern is incorrect trusted time, not direct code execution. Exposure is limited to systems running OpenNTPD before 6.0p1 that use HTTPS constraints. The provided sources do not identify specific operating-system packages, distributions, or default configurations beyond OpenNTPD before 6.0p1. Prioritize remediation for servers where accurate time supports security controls, audit logs, authentication, or certificate validation. The issue is not known from these sources to be actively exploited, but it can undermine trust in system time. Mitigation focus: Upgrade OpenNTPD to 6.0p1 or a vendor package containing the fix.; Check vendor advisories for distribution-specific backports and package names.; Review OpenNTPD constraint configuration on exposed or security-critical hosts..

Prepared

Jun 13, 2026, 06:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.