Every CVE Search/ Get API key

CVE-2018-5741

Update policies krb5-subdomain and ms-subdomain do not enforce controls promised in their documentation

6.5 MediumFix available

To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when sending the update request. Unfortunately, some rule types were not initially documented, and when documentation for them was added to the Administrator Reference Manual (ARM) in change #3112, the language that was added to the ARM at that time incorrectly described the behavior of two rule types, krb5-subdomain and ms-subdomain. This incorrect documentation could mislead operators into believing that policies they had configured were more restrictive than they actually were. This affects BIND versions prior to BIND 9.11.5 and BIND 9.12.3.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

3.45%Up 1.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 6.5

Update policies krb5-subdomain and ms-subdomain do not enforce controls promised in their documentation

To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when sending the update request. Unfortunately, some rule types were not initially documented, and when documentation for them was added to the Administrator Reference Manual (ARM) in change #3112, the language that was added to the ARM at that time incorrectly described the behavior of two rule types, krb5-subdomain and ms-subdomain. This incorrect documentation could mislead operators into believing that policies they had configured were more restrictive than they actually were. This affects BIND versions prior to BIND 9.11.5 and BIND 9.12.3.

Record
CVE-2018-5741
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
EUVDEUVD-2018-17510 6.5

To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when sending the update request. Unfortunately, some rule types were not initially documented, and when documentation for them was added to the Administrator Reference Manual (ARM) in change #3112, the language that was added to the ARM at that time incorrectly described the behavior of two rule types, krb5-subdomain and ms-subdomain. This incorrect documentation could mislead operators into believing that policies they had configured were more restrictive than they actually were. This affects BIND versions prior to BIND 9.11.5 and BIND 9.12.3.

Record
EUVD-2018-17510
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-ghpp-72v8-mpmv 6.5

To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in...

To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when sending the update request. Unfortunately, some rule types were not initially documented, and when documentation for them was added to the Administrator Reference Manual (ARM) in change #3112, the language that was added to the ARM at that time incorrectly described the behavior of two rule types, krb5-subdomain and ms-subdomain. This incorrect documentation could mislead operators into believing that policies they had configured were more restrictive than they actually were. This affects BIND versions prior to BIND 9.11.5 and BIND 9.12.3.

Record
GHSA-ghpp-72v8-mpmv
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-863
Updated
2026-11-02
NVD 6.5

To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when sending the update request. Unfortunately, some rule types were not initially documented, and when documentation for them was added to the Administrator Reference Manual (ARM) in change #3112, the language that was added to the ARM at that time incorrectly described the behavior of two rule types, krb5-subdomain and ms-subdomain. This incorrect documentation could mislead operators into believing that policies they had configured were more restrictive than they actually were. This affects BIND versions prior to BIND 9.11.5 and BIND 9.12.3.

Record
CVE-2018-5741
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0
4.0 MediumAV:N/AC:L/Au:S/C:N/I:P/A:N
Weakness
CWE-863
Updated
2026-11-02
OSVALPINE-CVE-2018-5741 6.5

To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when sending the update request. Unfortunately, some rule types were not initially documented, and when documentation for them was added to the Administrator Reference Manual (ARM) in change #3112, the language that was added to the ARM at that time incorrectly described the behavior of two rule types, krb5-subdomain and ms-subdomain. This incorrect documentation could mislead operators into believing that policies they had configured were more restrictive than they actually were. This affects BIND versions prior to BIND 9.11.5 and BIND 9.12.3.

Record
ALPINE-CVE-2018-5741
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSV 6.5

To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when sending the update request. Unfortunately, some rule types were not initially documented, and when documentation for them was added to the Administrator Reference Manual (ARM) in change #3112, the language that was added to the ARM at that time incorrectly described the behavior of two rule types, krb5-subdomain and ms-subdomain. This incorrect documentation could mislead operators into believing that policies they had configured were more restrictive than they actually were. This affects BIND versions prior to BIND 9.11.5 and BIND 9.12.3.

Record
CVE-2018-5741
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 10 moreShow less
OSVDEBIAN-CVE-2018-5741 6.5

To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when sending the update request. Unfortunately, some rule types were not initially documented, and when documentation for them was added to the Administrator Reference Manual (ARM) in change #3112, the language that was added to the ARM at that time incorrectly described the behavior of two rule types, krb5-subdomain and ms-subdomain. This incorrect documentation could mislead operators into believing that policies they had configured were more restrictive than they actually were. This affects BIND versions prior to BIND 9.11.5 and BIND 9.12.3.

Record
DEBIAN-CVE-2018-5741
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2019:2057 6.5

Red Hat Security Advisory: bind security, bug fix, and enhancement update

Record
RHSA-2019:2057
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2018-5741 6.5

To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when sending the update request. Unfortunately, some rule types were not initially documented, and when documentation for them was added to the Administrator Reference Manual (ARM) in change #3112, the language that was added to the ARM at that time incorrectly described the behavior of two rule types, krb5-subdomain and ms-subdomain. This incorrect documentation could mislead operators into believing that policies they had configured were more restrictive than they actually were. This affects BIND versions prior to BIND 9.11.5 and BIND 9.12.3.

Record
UBUNTU-CVE-2018-5741
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVCLSA-2022-1657560205 No score

Fixed CVE-2018-5741 in bind

  • CVE-2018-5741: update {krb5,ms}-{self,subdomain} descriptions
Record
CLSA-2022-1657560205
Updated
2026-11-02
OSVCLSA-2022-1657561196 No score

Fixed CVE-2018-5741 in bind

  • CVE-2018-5741: update {krb5,ms}-{self,subdomain} descriptions
Record
CLSA-2022-1657561196
Updated
2026-11-02
OSVopenSUSE-SU-2020:1699-1 No score

Security update for bind

This update for bind fixes the following issues:

BIND was upgraded to version 9.16.6:

Note:

  • bind is now more strict in regards to DNSSEC. If queries are not working, check for DNSSEC issues. For instance, if bind is used in a namserver forwarder chain, the forwarding DNS servers must support DNSSEC.

Fixing security issues:

  • CVE-2020-8616: Further limit the number of queries that can be triggered from a request. Root and TLD servers are no longer exempt from max-recursion-queries. Fetches for missing name server. (bsc#1171740) Address records are limited to 4 for any domain.
  • CVE-2020-8617: Replaying a TSIG BADTIME response as a request could trigger an assertion failure. (bsc#1171740)
  • CVE-2019-6477: Fixed an issue where TCP-pipelined queries could bypass the tcp-clients limit (bsc#1157051).
  • CVE-2018-5741: Fixed the documentation (bsc#1109160).
  • CVE-2020-8618: It was possible to trigger an INSIST when determining whether a record would fit into a TCP message buffer (bsc#1172958).
  • CVE-2020-8619: It was possible to trigger an INSIST in lib/dns/rbtdb.c:new_reference() with a particular zone content and query patterns (bsc#1172958).
  • CVE-2020-8624: 'update-policy' rules of type 'subdomain' were incorrectly treated as 'zonesub' rules, which allowed keys used in 'subdomain' rules to update names outside of the specified subdomains. The problem was fixed by making sure 'subdomain' rules are again processed as described in the ARM (bsc#1175443).
  • CVE-2020-8623: When BIND 9 was compiled with native PKCS#11 support, it was possible to trigger an assertion failure in code determining the number of bits in the PKCS#11 RSA public key with a specially crafted packet (bsc#1175443).
  • CVE-2020-8621: named could crash in certain query resolution scenarios where QNAME minimization and forwarding were both enabled (bsc#1175443).
  • CVE-2020-8620: It was possible to trigger an assertion failure by sending a specially crafted large TCP DNS message (bsc#1175443).
  • CVE-2020-8622: It was possible to trigger an assertion failure when verifying the response to a TSIG-signed request (bsc#1175443).

Other issues fixed:

  • Add engine support to OpenSSL EdDSA implementation.
  • Add engine support to OpenSSL ECDSA implementation.
  • Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  • Warn about AXFR streams with inconsistent message IDs.
  • Make ISC rwlock implementation the default again.
  • Fixed issues when using cookie-secrets for AES and SHA2 (bsc#1161168)
  • Installed the default files in /var/lib/named and created chroot environment on systems using transactional-updates (bsc#1100369, fate#325524)
  • Fixed an issue where bind was not working in FIPS mode (bsc#906079).
  • Fixed dependency issues (bsc#1118367 and bsc#1118368).
  • GeoIP support is now discontinued, now GeoIP2 is used(bsc#1156205).
  • Fixed an issue with FIPS (bsc#1128220).
  • The liblwres library is discontinued upstream and is no longer included.
  • Added service dependency on NTP to make sure the clock is accurate when bind is starts (bsc#1170667, bsc#1170713).
  • Reject DS records at the zone apex when loading master files. Log but otherwise ignore attempts to add DS records at the zone apex via UPDATE.
  • The default value of 'max-stale-ttl' has been changed from 1 week to 12 hours.
  • Zone timers are now exported via statistics channel.
  • The 'primary' and 'secondary' keywords, when used as parameters for 'check-names', were not processed correctly and were being ignored.
  • 'rndc dnstap -roll <value>' did not limit the number of saved files to <value>.
  • Add 'rndc dnssec -status' command.
  • Addressed a couple of situations where named could crash.
  • Changed /var/lib/named to owner root:named and perms rwxrwxr-t so that named, being a/the only member of the 'named' group has full r/w access yet cannot change directories owned by root in the case of a compromized named. [bsc#1173307, bind-chrootenv.conf]
  • Added…
Record
openSUSE-SU-2020:1699-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:1701-1 No score

Security update for bind

This update for bind fixes the following issues:

BIND was upgraded to version 9.16.6:

Note:

  • bind is now more strict in regards to DNSSEC. If queries are not working, check for DNSSEC issues. For instance, if bind is used in a namserver forwarder chain, the forwarding DNS servers must support DNSSEC.

Fixing security issues:

  • CVE-2020-8616: Further limit the number of queries that can be triggered from a request. Root and TLD servers are no longer exempt from max-recursion-queries. Fetches for missing name server. (bsc#1171740) Address records are limited to 4 for any domain.
  • CVE-2020-8617: Replaying a TSIG BADTIME response as a request could trigger an assertion failure. (bsc#1171740)
  • CVE-2019-6477: Fixed an issue where TCP-pipelined queries could bypass the tcp-clients limit (bsc#1157051).
  • CVE-2018-5741: Fixed the documentation (bsc#1109160).
  • CVE-2020-8618: It was possible to trigger an INSIST when determining whether a record would fit into a TCP message buffer (bsc#1172958).
  • CVE-2020-8619: It was possible to trigger an INSIST in lib/dns/rbtdb.c:new_reference() with a particular zone content and query patterns (bsc#1172958).
  • CVE-2020-8624: 'update-policy' rules of type 'subdomain' were incorrectly treated as 'zonesub' rules, which allowed keys used in 'subdomain' rules to update names outside of the specified subdomains. The problem was fixed by making sure 'subdomain' rules are again processed as described in the ARM (bsc#1175443).
  • CVE-2020-8623: When BIND 9 was compiled with native PKCS#11 support, it was possible to trigger an assertion failure in code determining the number of bits in the PKCS#11 RSA public key with a specially crafted packet (bsc#1175443).
  • CVE-2020-8621: named could crash in certain query resolution scenarios where QNAME minimization and forwarding were both enabled (bsc#1175443).
  • CVE-2020-8620: It was possible to trigger an assertion failure by sending a specially crafted large TCP DNS message (bsc#1175443).
  • CVE-2020-8622: It was possible to trigger an assertion failure when verifying the response to a TSIG-signed request (bsc#1175443).

Other issues fixed:

  • Add engine support to OpenSSL EdDSA implementation.
  • Add engine support to OpenSSL ECDSA implementation.
  • Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  • Warn about AXFR streams with inconsistent message IDs.
  • Make ISC rwlock implementation the default again.
  • Fixed issues when using cookie-secrets for AES and SHA2 (bsc#1161168)
  • Installed the default files in /var/lib/named and created chroot environment on systems using transactional-updates (bsc#1100369, fate#325524)
  • Fixed an issue where bind was not working in FIPS mode (bsc#906079).
  • Fixed dependency issues (bsc#1118367 and bsc#1118368).
  • GeoIP support is now discontinued, now GeoIP2 is used(bsc#1156205).
  • Fixed an issue with FIPS (bsc#1128220).
  • The liblwres library is discontinued upstream and is no longer included.
  • Added service dependency on NTP to make sure the clock is accurate when bind is starts (bsc#1170667, bsc#1170713).
  • Reject DS records at the zone apex when loading master files. Log but otherwise ignore attempts to add DS records at the zone apex via UPDATE.
  • The default value of 'max-stale-ttl' has been changed from 1 week to 12 hours.
  • Zone timers are now exported via statistics channel.
  • The 'primary' and 'secondary' keywords, when used as parameters for 'check-names', were not processed correctly and were being ignored.
  • 'rndc dnstap -roll <value>' did not limit the number of saved files to <value>.
  • Add 'rndc dnssec -status' command.
  • Addressed a couple of situations where named could crash.
  • Changed /var/lib/named to owner root:named and perms rwxrwxr-t so that named, being a/the only member of the 'named' group has full r/w access yet cannot change directories owned by root in the case of a compromized named. [bsc#1173307, bind-chrootenv.conf]
  • Added…
Record
openSUSE-SU-2020:1701-1
Updated
2026-11-02
OSVSUSE-SU-2020:14400-1 No score

Security update for bind

This update for bind fixes the following issues:

  • CVE-2020-8616: Fixed the insufficient limit on the number of fetches performed when processing referrals (bsc#1171740).
  • CVE-2020-8617: Fixed a logic error in code which checks TSIG validity (bsc#1171740).
  • CVE-2018-5741: Fixed the documentation (bsc#1109160).
  • Removed rndc.key generation from bind.spec file (bsc#1092283, bsc#1033843) bind should create the key on first boot or if it went missing.
Record
SUSE-SU-2020:14400-1
Updated
2026-11-02
OSVSUSE-SU-2020:1914-1 No score

Security update for bind

This update for bind fixes the following issues:

  • Amended documentation referring to rule types 'krb5-subdomain' and 'ms-subdomain'. This incorrect documentation could mislead operators into believing that policies they had configured were more restrictive than they actually were. [CVE-2018-5741]

  • Further limit the number of queries that can be triggered from a request. Root and TLD servers are no longer exempt from max-recursion-queries. Fetches for missing name server address records are limited to 4 for any domain. [CVE-2020-8616]

  • Replaying a TSIG BADTIME response as a request could trigger an assertion failure. [CVE-2020-8617] [bsc#1109160, bsc#1171740, CVE-2018-5741, bind-CVE-2018-5741.patch, CVE-2020-8616, bind-CVE-2020-8616.patch, CVE-2020-8617, bind-CVE-2020-8617.patch]

  • Don't rely on /etc/insserv.conf anymore for proper dependencies against nss-lookup.target in named.service and lwresd.service (bsc#1118367 bsc#1118368)

  • Using a drop-in file

Record
SUSE-SU-2020:1914-1
Updated
2026-11-02
OSVSUSE-SU-2020:2914-1 No score

Security update for bind

This update for bind fixes the following issues:

BIND was upgraded to version 9.16.6:

Note:

  • bind is now more strict in regards to DNSSEC. If queries are not working, check for DNSSEC issues. For instance, if bind is used in a namserver forwarder chain, the forwarding DNS servers must support DNSSEC.

Fixing security issues:

  • CVE-2020-8616: Further limit the number of queries that can be triggered from a request. Root and TLD servers are no longer exempt from max-recursion-queries. Fetches for missing name server. (bsc#1171740) Address records are limited to 4 for any domain.
  • CVE-2020-8617: Replaying a TSIG BADTIME response as a request could trigger an assertion failure. (bsc#1171740)
  • CVE-2019-6477: Fixed an issue where TCP-pipelined queries could bypass the tcp-clients limit (bsc#1157051).
  • CVE-2018-5741: Fixed the documentation (bsc#1109160).
  • CVE-2020-8618: It was possible to trigger an INSIST when determining whether a record would fit into a TCP message buffer (bsc#1172958).
  • CVE-2020-8619: It was possible to trigger an INSIST in lib/dns/rbtdb.c:new_reference() with a particular zone content and query patterns (bsc#1172958).
  • CVE-2020-8624: 'update-policy' rules of type 'subdomain' were incorrectly treated as 'zonesub' rules, which allowed keys used in 'subdomain' rules to update names outside of the specified subdomains. The problem was fixed by making sure 'subdomain' rules are again processed as described in the ARM (bsc#1175443).
  • CVE-2020-8623: When BIND 9 was compiled with native PKCS#11 support, it was possible to trigger an assertion failure in code determining the number of bits in the PKCS#11 RSA public key with a specially crafted packet (bsc#1175443).
  • CVE-2020-8621: named could crash in certain query resolution scenarios where QNAME minimization and forwarding were both enabled (bsc#1175443).
  • CVE-2020-8620: It was possible to trigger an assertion failure by sending a specially crafted large TCP DNS message (bsc#1175443).
  • CVE-2020-8622: It was possible to trigger an assertion failure when verifying the response to a TSIG-signed request (bsc#1175443).

Other issues fixed:

  • Add engine support to OpenSSL EdDSA implementation.
  • Add engine support to OpenSSL ECDSA implementation.
  • Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  • Warn about AXFR streams with inconsistent message IDs.
  • Make ISC rwlock implementation the default again.
  • Fixed issues when using cookie-secrets for AES and SHA2 (bsc#1161168)
  • Installed the default files in /var/lib/named and created chroot environment on systems using transactional-updates (bsc#1100369, fate#325524)
  • Fixed an issue where bind was not working in FIPS mode (bsc#906079).
  • Fixed dependency issues (bsc#1118367 and bsc#1118368).
  • GeoIP support is now discontinued, now GeoIP2 is used(bsc#1156205).
  • Fixed an issue with FIPS (bsc#1128220).
  • The liblwres library is discontinued upstream and is no longer included.
  • Added service dependency on NTP to make sure the clock is accurate when bind is starts (bsc#1170667, bsc#1170713).
  • Reject DS records at the zone apex when loading master files. Log but otherwise ignore attempts to add DS records at the zone apex via UPDATE.
  • The default value of 'max-stale-ttl' has been changed from 1 week to 12 hours.
  • Zone timers are now exported via statistics channel.
  • The 'primary' and 'secondary' keywords, when used as parameters for 'check-names', were not processed correctly and were being ignored.
  • 'rndc dnstap -roll <value>' did not limit the number of saved files to <value>.
  • Add 'rndc dnssec -status' command.
  • Addressed a couple of situations where named could crash.
  • Changed /var/lib/named to owner root:named and perms rwxrwxr-t so that named, being a/the only member of the 'named' group has full r/w access yet cannot change directories owned by root in the case of a compromized named. [bsc#1173307, bind-chrootenv.conf]
  • Added…
Record
SUSE-SU-2020:2914-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
bind
Alpine:v3.6
 9.12.0 up to 9.11.5-r0
9.11.5-r0
bind
Alpine:v3.7
 9.12.0 up to 9.11.5-r0
9.11.5-r0
bind
Alpine:v3.8
 9.12.0 up to 9.12.3-r0
9.12.3-r0
bind
Alpine:v3.9
 9.12.0 up to 9.12.3-r0
9.12.3-r0
bind
TuxCare:OracleLinux:6
 before 33:9.8.2-0.68.rc1.el6.11.tuxcare.els5
33:9.8.2-0.68.rc1.el6.11.tuxcare.els5
bind-chroot
TuxCare:OracleLinux:6
 before 33:9.8.2-0.68.rc1.el6.11.tuxcare.els5
33:9.8.2-0.68.rc1.el6.11.tuxcare.els5
bind-devel
TuxCare:OracleLinux:6
 before 33:9.8.2-0.68.rc1.el6.11.tuxcare.els5
33:9.8.2-0.68.rc1.el6.11.tuxcare.els5
bind-libs
TuxCare:OracleLinux:6
 before 33:9.8.2-0.68.rc1.el6.11.tuxcare.els5
33:9.8.2-0.68.rc1.el6.11.tuxcare.els5
bind-sdb
TuxCare:OracleLinux:6
 before 33:9.8.2-0.68.rc1.el6.11.tuxcare.els5
33:9.8.2-0.68.rc1.el6.11.tuxcare.els5
bind-utils
TuxCare:OracleLinux:6
 before 33:9.8.2-0.68.rc1.el6.11.tuxcare.els5
33:9.8.2-0.68.rc1.el6.11.tuxcare.els5
Show 114 moreShow less
Affected packages
PackageAffectedFixed
bind
TuxCare:CentOS:6
 before 33:9.8.2-0.68.rc1.el6.11.tuxcare.els5
33:9.8.2-0.68.rc1.el6.11.tuxcare.els5
bind-chroot
TuxCare:CentOS:6
 before 33:9.8.2-0.68.rc1.el6.11.tuxcare.els5
33:9.8.2-0.68.rc1.el6.11.tuxcare.els5
bind-devel
TuxCare:CentOS:6
 before 33:9.8.2-0.68.rc1.el6.11.tuxcare.els5
33:9.8.2-0.68.rc1.el6.11.tuxcare.els5
bind-libs
TuxCare:CentOS:6
 before 33:9.8.2-0.68.rc1.el6.11.tuxcare.els5
33:9.8.2-0.68.rc1.el6.11.tuxcare.els5
bind-sdb
TuxCare:CentOS:6
 before 33:9.8.2-0.68.rc1.el6.11.tuxcare.els5
33:9.8.2-0.68.rc1.el6.11.tuxcare.els5
bind-utils
TuxCare:CentOS:6
 before 33:9.8.2-0.68.rc1.el6.11.tuxcare.els5
33:9.8.2-0.68.rc1.el6.11.tuxcare.els5
bind9
Debian:12
 before 1:9.11.5+dfsg-1
1:9.11.5+dfsg-1
bind9
Debian:13
 before 1:9.11.5+dfsg-1
1:9.11.5+dfsg-1
bind9
Debian:14
 before 1:9.11.5+dfsg-1
1:9.11.5+dfsg-1
bind
Red Hat:enterprise_linux:7::client
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-debuginfo
Red Hat:enterprise_linux:7::client
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-export-libs
Red Hat:enterprise_linux:7::client
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-libs
Red Hat:enterprise_linux:7::client
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-libs-lite
Red Hat:enterprise_linux:7::client
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-license
Red Hat:enterprise_linux:7::client
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-utils
Red Hat:enterprise_linux:7::client
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-chroot
Red Hat:enterprise_linux:7::client
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-devel
Red Hat:enterprise_linux:7::client
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-export-devel
Red Hat:enterprise_linux:7::client
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-lite-devel
Red Hat:enterprise_linux:7::client
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-pkcs11
Red Hat:enterprise_linux:7::client
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-pkcs11-devel
Red Hat:enterprise_linux:7::client
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-pkcs11-libs
Red Hat:enterprise_linux:7::client
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-pkcs11-utils
Red Hat:enterprise_linux:7::client
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-sdb
Red Hat:enterprise_linux:7::client
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-sdb-chroot
Red Hat:enterprise_linux:7::client
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind
Red Hat:enterprise_linux:7::computenode
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-export-libs
Red Hat:enterprise_linux:7::computenode
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-libs
Red Hat:enterprise_linux:7::computenode
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-libs-lite
Red Hat:enterprise_linux:7::computenode
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-license
Red Hat:enterprise_linux:7::computenode
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-utils
Red Hat:enterprise_linux:7::computenode
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-chroot
Red Hat:enterprise_linux:7::computenode
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-devel
Red Hat:enterprise_linux:7::computenode
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-export-devel
Red Hat:enterprise_linux:7::computenode
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-lite-devel
Red Hat:enterprise_linux:7::computenode
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-pkcs11
Red Hat:enterprise_linux:7::computenode
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-pkcs11-devel
Red Hat:enterprise_linux:7::computenode
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-pkcs11-libs
Red Hat:enterprise_linux:7::computenode
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-pkcs11-utils
Red Hat:enterprise_linux:7::computenode
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-sdb
Red Hat:enterprise_linux:7::computenode
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-sdb-chroot
Red Hat:enterprise_linux:7::computenode
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind
Red Hat:enterprise_linux:7::server
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-chroot
Red Hat:enterprise_linux:7::server
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-debuginfo
Red Hat:enterprise_linux:7::server
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-export-libs
Red Hat:enterprise_linux:7::server
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-libs
Red Hat:enterprise_linux:7::server
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-libs-lite
Red Hat:enterprise_linux:7::server
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-license
Red Hat:enterprise_linux:7::server
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-pkcs11
Red Hat:enterprise_linux:7::server
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-pkcs11-libs
Red Hat:enterprise_linux:7::server
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-pkcs11-utils
Red Hat:enterprise_linux:7::server
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-utils
Red Hat:enterprise_linux:7::server
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-devel
Red Hat:enterprise_linux:7::server
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-export-devel
Red Hat:enterprise_linux:7::server
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-lite-devel
Red Hat:enterprise_linux:7::server
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-pkcs11-devel
Red Hat:enterprise_linux:7::server
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-sdb
Red Hat:enterprise_linux:7::server
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-sdb-chroot
Red Hat:enterprise_linux:7::server
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind
Red Hat:enterprise_linux:7::workstation
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-chroot
Red Hat:enterprise_linux:7::workstation
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-export-libs
Red Hat:enterprise_linux:7::workstation
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-libs
Red Hat:enterprise_linux:7::workstation
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-libs-lite
Red Hat:enterprise_linux:7::workstation
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-license
Red Hat:enterprise_linux:7::workstation
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-pkcs11
Red Hat:enterprise_linux:7::workstation
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-pkcs11-libs
Red Hat:enterprise_linux:7::workstation
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-pkcs11-utils
Red Hat:enterprise_linux:7::workstation
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-utils
Red Hat:enterprise_linux:7::workstation
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-devel
Red Hat:enterprise_linux:7::workstation
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-export-devel
Red Hat:enterprise_linux:7::workstation
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-lite-devel
Red Hat:enterprise_linux:7::workstation
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-pkcs11-devel
Red Hat:enterprise_linux:7::workstation
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-sdb
Red Hat:enterprise_linux:7::workstation
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind-sdb-chroot
Red Hat:enterprise_linux:7::workstation
 before 32:9.11.4-9.P2.el7
32:9.11.4-9.P2.el7
bind
SUSE:Linux Enterprise Point of Sale 11 SP3
From an advisory covering 3 CVEs
 before 9.9.6P1-0.51.20.1
9.9.6P1-0.51.20.1
bind
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 3 CVEs
 before 9.9.6P1-0.51.20.1
9.9.6P1-0.51.20.1
bind
SUSE:HPE Helion OpenStack 8
From an advisory covering 3 CVEs
 before 9.9.9P1-63.17.1
9.9.9P1-63.17.1
bind
SUSE:OpenStack Cloud 7
From an advisory covering 3 CVEs
 before 9.9.9P1-63.17.1
9.9.9P1-63.17.1
bind
SUSE:OpenStack Cloud 8
From an advisory covering 3 CVEs
 before 9.9.9P1-63.17.1
9.9.9P1-63.17.1
bind
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 3 CVEs
 before 9.9.9P1-63.17.1
9.9.9P1-63.17.1
bind
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 3 CVEs
 before 9.9.9P1-63.17.1
9.9.9P1-63.17.1
bind
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 3 CVEs
 before 9.9.9P1-63.17.1
9.9.9P1-63.17.1
bind
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 3 CVEs
 before 9.9.9P1-63.17.1
9.9.9P1-63.17.1
bind
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 3 CVEs
 before 9.9.9P1-63.17.1
9.9.9P1-63.17.1
bind
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 3 CVEs
 before 9.9.9P1-63.17.1
9.9.9P1-63.17.1
bind
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 3 CVEs
 before 9.9.9P1-63.17.1
9.9.9P1-63.17.1
bind
SUSE:Enterprise Storage 5
From an advisory covering 3 CVEs
 before 9.9.9P1-63.17.1
9.9.9P1-63.17.1
bind
SUSE:Linux Enterprise Module for Basesystem 15 SP1
From an advisory covering 12 CVEs
 before 9.16.6-12.32.1
9.16.6-12.32.1
sysuser-tools
SUSE:Linux Enterprise Module for Basesystem 15 SP1
From an advisory covering 12 CVEs
 before 2.0-4.2.8
2.0-4.2.8
bind
SUSE:Linux Enterprise Module for Basesystem 15 SP2
From an advisory covering 12 CVEs
 before 9.16.6-12.32.1
9.16.6-12.32.1
sysuser-tools
SUSE:Linux Enterprise Module for Basesystem 15 SP2
From an advisory covering 12 CVEs
 before 2.0-4.2.8
2.0-4.2.8
sysuser-tools
SUSE:Linux Enterprise Module for Development Tools 15 SP2
From an advisory covering 12 CVEs
 before 2.0-4.2.8
2.0-4.2.8
bind
SUSE:Linux Enterprise Module for Server Applications 15 SP1
From an advisory covering 12 CVEs
 before 9.16.6-12.32.1
9.16.6-12.32.1
bind
SUSE:Linux Enterprise Module for Server Applications 15 SP2
From an advisory covering 12 CVEs
 before 9.16.6-12.32.1
9.16.6-12.32.1
bind
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 12 CVEs
 before 9.16.6-12.32.1
9.16.6-12.32.1
sysuser-tools
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 12 CVEs
 before 2.0-4.2.8
2.0-4.2.8
bind
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 12 CVEs
 before 9.16.6-12.32.1
9.16.6-12.32.1
sysuser-tools
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 12 CVEs
 before 2.0-4.2.8
2.0-4.2.8
bind
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 12 CVEs
 before 9.16.6-12.32.1
9.16.6-12.32.1
sysuser-tools
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 12 CVEs
 before 2.0-4.2.8
2.0-4.2.8
bind
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 12 CVEs
 before 9.16.6-12.32.1
9.16.6-12.32.1
sysuser-tools
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 12 CVEs
 before 2.0-4.2.8
2.0-4.2.8
bind9
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1:9.9.3.dfsg.P2-4ubuntu11:9.9.3.dfsg.P2-4ubuntu21:9.9.3.dfsg.P2-4ubuntu31:9.9.5.dfsg-21:9.9.5.dfsg-3
Show 33 moreShow less
1:9.9.5.dfsg-3ubuntu0.11:9.9.5.dfsg-3ubuntu0.21:9.9.5.dfsg-3ubuntu0.31:9.9.5.dfsg-3ubuntu0.41:9.9.5.dfsg-3ubuntu0.51:9.9.5.dfsg-3ubuntu0.61:9.9.5.dfsg-3ubuntu0.71:9.9.5.dfsg-3ubuntu0.81:9.9.5.dfsg-3ubuntu0.91:9.9.5.dfsg-3ubuntu0.101:9.9.5.dfsg-3ubuntu0.111:9.9.5.dfsg-3ubuntu0.121:9.9.5.dfsg-3ubuntu0.131:9.9.5.dfsg-3ubuntu0.141:9.9.5.dfsg-3ubuntu0.151:9.9.5.dfsg-3ubuntu0.161:9.9.5.dfsg-3ubuntu0.171:9.9.5.dfsg-3ubuntu0.181:9.9.5.dfsg-3ubuntu0.191:9.9.5.dfsg-3ubuntu0.19+esm11:9.9.5.dfsg-3ubuntu0.19+esm21:9.9.5.dfsg-3ubuntu0.19+esm31:9.9.5.dfsg-3ubuntu0.19+esm41:9.9.5.dfsg-3ubuntu0.19+esm51:9.9.5.dfsg-3ubuntu0.19+esm61:9.9.5.dfsg-3ubuntu0.19+esm71:9.9.5.dfsg-3ubuntu0.19+esm91:9.9.5.dfsg-3ubuntu0.19+esm101:9.9.5.dfsg-3ubuntu0.19+esm111:9.9.5.dfsg-3ubuntu0.19+esm121:9.9.5.dfsg-3ubuntu0.19+esm131:9.9.5.dfsg-3ubuntu0.19+esm141:9.9.5.dfsg-3ubuntu0.19+esm15
 None known
bind9
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1:9.9.5.dfsg-11ubuntu11:9.9.5.dfsg-121:9.9.5.dfsg-12.11:9.9.5.dfsg-12.1ubuntu11:9.10.3.dfsg.P2-4
Show 34 moreShow less
1:9.10.3.dfsg.P2-51:9.10.3.dfsg.P4-31:9.10.3.dfsg.P4-41:9.10.3.dfsg.P4-51:9.10.3.dfsg.P4-81:9.10.3.dfsg.P4-8ubuntu11:9.10.3.dfsg.P4-8ubuntu1.11:9.10.3.dfsg.P4-8ubuntu1.21:9.10.3.dfsg.P4-8ubuntu1.31:9.10.3.dfsg.P4-8ubuntu1.41:9.10.3.dfsg.P4-8ubuntu1.51:9.10.3.dfsg.P4-8ubuntu1.61:9.10.3.dfsg.P4-8ubuntu1.71:9.10.3.dfsg.P4-8ubuntu1.81:9.10.3.dfsg.P4-8ubuntu1.91:9.10.3.dfsg.P4-8ubuntu1.101:9.10.3.dfsg.P4-8ubuntu1.111:9.10.3.dfsg.P4-8ubuntu1.121:9.10.3.dfsg.P4-8ubuntu1.141:9.10.3.dfsg.P4-8ubuntu1.151:9.10.3.dfsg.P4-8ubuntu1.161:9.10.3.dfsg.P4-8ubuntu1.171:9.10.3.dfsg.P4-8ubuntu1.181:9.10.3.dfsg.P4-8ubuntu1.191:9.10.3.dfsg.P4-8ubuntu1.19+esm11:9.10.3.dfsg.P4-8ubuntu1.19+esm21:9.10.3.dfsg.P4-8ubuntu1.19+esm31:9.10.3.dfsg.P4-8ubuntu1.19+esm51:9.10.3.dfsg.P4-8ubuntu1.19+esm61:9.10.3.dfsg.P4-8ubuntu1.19+esm71:9.10.3.dfsg.P4-8ubuntu1.19+esm81:9.10.3.dfsg.P4-8ubuntu1.19+esm91:9.10.3.dfsg.P4-8ubuntu1.19+esm101:9.10.3.dfsg.P4-8ubuntu1.19+esm11
 None known
bind9
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1:9.10.3.dfsg.P4-12.6ubuntu11:9.11.2.P1-1ubuntu21:9.11.2.P1-1ubuntu31:9.11.2.P1-1ubuntu41:9.11.2.P1-1ubuntu5
Show 23 moreShow less
1:9.11.3+dfsg-1ubuntu11:9.11.3+dfsg-1ubuntu1.11:9.11.3+dfsg-1ubuntu1.21:9.11.3+dfsg-1ubuntu1.31:9.11.3+dfsg-1ubuntu1.51:9.11.3+dfsg-1ubuntu1.71:9.11.3+dfsg-1ubuntu1.81:9.11.3+dfsg-1ubuntu1.91:9.11.3+dfsg-1ubuntu1.101:9.11.3+dfsg-1ubuntu1.111:9.11.3+dfsg-1ubuntu1.121:9.11.3+dfsg-1ubuntu1.131:9.11.3+dfsg-1ubuntu1.141:9.11.3+dfsg-1ubuntu1.151:9.11.3+dfsg-1ubuntu1.161:9.11.3+dfsg-1ubuntu1.171:9.11.3+dfsg-1ubuntu1.181:9.11.3+dfsg-1ubuntu1.19+esm11:9.11.3+dfsg-1ubuntu1.19+esm21:9.11.3+dfsg-1ubuntu1.19+esm31:9.11.3+dfsg-1ubuntu1.19+esm41:9.11.3+dfsg-1ubuntu1.19+esm51:9.11.3+dfsg-1ubuntu1.19+esm6
 None known
bind
openSUSE:Leap 15.2
From an advisory covering 12 CVEs
 before 9.16.6-lp152.14.3.1
9.16.6-lp152.14.3.1
libuv
openSUSE:Leap 15.2
From an advisory covering 12 CVEs
 before 1.18.0-lp152.4.3.1
1.18.0-lp152.4.3.1
sysuser-tools
openSUSE:Leap 15.2
From an advisory covering 12 CVEs
 before 2.0-lp152.5.3.1
2.0-lp152.5.3.1
bind
openSUSE:Leap 15.1
From an advisory covering 12 CVEs
 before 9.16.6-lp151.11.9.1
9.16.6-lp151.11.9.1
libuv
openSUSE:Leap 15.1
From an advisory covering 12 CVEs
 before 1.18.0-lp151.3.3.1
1.18.0-lp151.3.3.1
sysuser-tools
openSUSE:Leap 15.1
From an advisory covering 12 CVEs
 before 2.0-lp151.4.3.1
2.0-lp151.4.3.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-5741 is a medium vulnerability (CVSS 6.5) in Isc Bind, published January 16, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.45%, the 89th percentile. Fixed in bind 9.11.5-r0.

References

Show 66 moreShow less
This page doesn't list everything

Left out here: the rest of 3 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open