CVE-2016-1567: Tuxfamily Chrony

High severity, CVSS 8.1. EPSS: 3% chance of exploitation in the next 30 days.

chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."

Affected products

• Tuxfamily Chrony: up to and including 1.31.1; version 2.0 only; version 2.1 only; version 2.1.1 only; version 2.2 only

Published 2016-01-26. Last modified 2026-06-17.