| Name | CVE-2018-5745 |
| Description | "managed-keys" is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which operators configure for use in DNSSEC validation. Due to an error in the managed-keys feature it is possible for a BIND server which uses managed-keys to exit due to an assertion failure if, during key rollover, a trust anchor's keys are replaced with keys which use an unsupported algorithm. Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5745. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-1697-1, DSA-4440-1, ELA-87-1 |
| Debian Bugs | 922954 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| bind9 (PTS) | jessie, jessie (lts) | 1:9.9.5.dfsg-9+deb8u31 | fixed |
| stretch (security) | 1:9.10.3.dfsg.P4-12.3+deb9u12 | fixed | |
| stretch (lts), stretch | 1:9.10.3.dfsg.P4-12.3+deb9u16 | fixed | |
| buster, buster (lts) | 1:9.11.5.P4+dfsg-5.1+deb10u13 | fixed | |
| buster (security) | 1:9.11.5.P4+dfsg-5.1+deb10u11 | fixed | |
| bullseye | 1:9.16.50-1~deb11u2 | fixed | |
| bullseye (security) | 1:9.16.50-1~deb11u1 | fixed | |
| bookworm (security), bookworm | 1:9.18.28-1~deb12u2 | fixed | |
| sid, trixie | 1:9.20.2-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| bind9 | source | wheezy | 1:9.8.4.dfsg.P1-6+nmu2+deb7u22 | ELA-87-1 | ||
| bind9 | source | jessie | 1:9.9.5.dfsg-9+deb8u17 | DLA-1697-1 | ||
| bind9 | source | stretch | 1:9.10.3.dfsg.P4-12.3+deb9u5 | DSA-4440-1 | ||
| bind9 | source | (unstable) | 1:9.11.5.P4+dfsg-1 | low | 922954 |
https://kb.isc.org/docs/cve-2018-5745
https://gitlab.isc.org/isc-projects/bind9/commit/235a64a5a4c0143b183bd55f6ed756741d4d7880
https://gitlab.isc.org/isc-projects/bind9/commit/38c2bdba0a5b785ef9f2da2329838b931754b3e4 (test)
https://gitlab.isc.org/isc-projects/bind9/commit/f09352d20a9d360e50683cd1d2fc52ccedcd77a0
https://gitlab.isc.org/isc-projects/bind9/commit/3022633d795bc9f04103ac9a354c026ce9b4eea3 (test)