Update ntp to 4.2.8p13 on CentOS

Question

I have NTP 4.2.6p5 installed on my CentOS 7.5. Due to "Network Time Protocol Multiple Security Vulnerabilities" vulnerability I have to upgrade it to latest NTP 4.2.8p13 version.

Now the problem is, I can not find latest available version using yum whatprovides.

[root@6ef77e1541c7 ~]# yum whatprovides ntp
 ntp-4.2.6p5-28.el7.centos.x86_64 : The NTP daemon and utilities
 Repo        : base

Anyone has any idea how do I upgrade NTP to latest version 4.2.8p13 to fix this vulnerability ?

EDIT-1

I've installed the NTP latest version from source but I'm not sure how do I start services when it is installed from source.

Also, I have removed old rpm packages.

EDIT-2

CVE-2015-7871, CVE-2015-7855, CVE-2015-7854, CVE-2015-7853, CVE-2015-7852, CVE- 
 2015-7851, CVE-2015-7850, CVE-2015-7849, CVE-2015-7848, CVE-2015-7701, CVE- 
 2015-7703, CVE-2015-7704, CVE-2015-7705, CVE-2015-7691, CVE-2015-7692, CVE- 
 2015-7702

Answer 1

You really should just use the package from CentOS. It has all the backported fixes, and CentOS will continue to fix security updates, unlike your build-from-source solution, which will need to be rebuilt each time NTP posts another CVE.

If you just run “yum update ntp” you will get all the following CVEs addressed. Whoever is telling you that those CVEs aren’t addressed should look at that page too. For many of them, Redhat says that the ntp package in el7 isn’t even affected.

Don’t blindly believe the security auditors, most often they’re just folks who got trained to run a tool on a windows computer (you are lucky if they even know about Linux) and parrot the results and have no depth of understanding of how an enterprise Linux OS works. Redhat (and subsequently CentOS) backports security fixes to a stable version of a package. Maintaining your own build of the latest version is actually more of a security risk because now you have to rebuild it each time there’s a security fix.

EDIT: Also, please direct your security auditors or anyone telling you to upgrade ntp to the latest version to read Redhat’s discussion of backports

.

Answer 2

For stability purposes and quick convergence and time maintence among many hosts, I have been using chrony instead of ntp. In fact, I believe that from RHEL/Centos 7.x chrony is the primary network time package provided by default.

However to your point, if you want to stay in sync of your distribution, you can just wait until a new version is released by the vendor. In the case of RHEL/Centos, the primary version listed on the package generally does not change at all during the life of the major point system revision. What happens is that patches get backported and the -# reflects the change. So although your package inventory indicates one version, it could very well be updated to the current version. This makes it hard for administrators to verify specific version numbers of a package globally and compare them.

If you really, really want to upgrade to the new version, you can download the source package and use that as a base to get to the new version. I have had to do this for some packages that were critical...its not all that hard, but you will have to weed through all the patches that already exist.