shield Security update for chrony

SUSE-SLE-Micro-6.0-490

This update for chrony fixes the following issues: - Update to version 4.8: * Add maxunreach option to limit selection of unreachable sources * Add -u option to chronyc to drop root privileges (default chronyc user is set by configure script) * Fix refclock extpps option to work on Linux >= 6.15 * Validate refclock samples for reachability updates - Fix racy socket creation allowing privilege escalation to root (bsc#1246544) - Update to version 4.7: * Add opencommands directive to select remote monitoring commands * Add interval option to driftfile directive * Add waitsynced and waitunsynced options to local directive * Add sanity checks for integer values in configuration * Add support for systemd Type=notify service * Add RTC refclock driver * Allow PHC refclock to be specified with network interface name * Don’t require multiple refclock samples per poll to simplify filter configuration * Keep refclock reachable when dropping samples with large delay * Improve quantile-based filtering to adapt faster to larger delay * Improve logging of selection failures * Detect clock interference from other processes * Try to reopen message log (-l option) on cyclelogs command * Fix sourcedir reloading to not multiply sources * Fix tracking offset after failed clock step * Drop support for NTS with Nettle < 3.6 and GnuTLS < 3.6.14 * Drop support for building without POSIX threads - Update to version 4.6.1: * Add ntsaeads directive to enable only selected AEAD algorithms for NTS. * Negotiate use of compliant NTS keys with AES-128-GCM-SIV AEAD algorithm. * Switch to compliant NTS keys if first response from server is NTS NAK. - Drop rcFOO symlinks for CODE16 (PED-266). - Update to version 4.6: * Add activate option to local directive to set activation threshold * Add ipv4 and ipv6 options to server/pool/peer directive * Add kod option to ratelimit directive for server KoD RATE support * Add leapseclist directive to read NIST/IERS leap-seconds.list file * Add ptpdomain directive to set PTP domain for NTP over PTP * Allow disabling pidfile * Improve copy server option to accept unsynchronised status instantly * Log one selection failure on start * Add offset command to modify source offset correction * Add timestamp sources to ntpdata report * Fix crash on sources reload during initstepslew or RTC initialisation * Fix source refreshment to not repeat failed name resolving attempts - Update to version 4.5: * Add support for AES-GCM-SIV in GnuTLS * Add support for corrections from PTP transparent clocks * Add support for systemd socket activation * Fix presend in interleaved mode * Fix reloading of modified sources from sourcedir

• Release Date
  Oct 14 2025
• References
  Bugzilla: 1246544
  
• Type
  security
• Severity
  moderate

cloud_download Downloads

SUSE Linux Micro 6.0 aarch64

• Packages
  chrony
  System Clock Synchronization Client and Server

  4.8-1.1 lock rpm

  chrony-pool-suse
  Chrony preconfiguration for SUSE

  4.8-1.1 lock rpm

SUSE Linux Micro 6.0 s390x

• Packages
  chrony
  System Clock Synchronization Client and Server

  4.8-1.1 lock rpm

  chrony-pool-suse
  Chrony preconfiguration for SUSE

  4.8-1.1 lock rpm

SUSE Linux Micro 6.0 x86_64

• Packages
  chrony
  System Clock Synchronization Client and Server

  4.8-1.1 lock rpm

  chrony-pool-suse
  Chrony preconfiguration for SUSE

  4.8-1.1 lock rpm