PT-2019-10992 · Isc+2 · Bind 9+2

Published 2019-01-29 · Updated 2019-11-07 · CVE-2018-5742

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: BIND9 versions 9.9.4-65.el7 through 9.9.4-72.el7

Description: The issue is related to an assertion failure in buffer.c:420, introduced while backporting a feature for a newer branch of BIND9. This problem affects RedHat versions of BIND9. It is also possible that other packages from different distributions that made the same error may be affected.

Recommendations: For BIND9 versions 9.9.4-65.el7 through 9.9.4-72.el7, consider updating to a version that does not contain the backported feature causing the assertion failure, or apply a patch that fixes the issue in buffer.c:420. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

CESA-2019_0194

CVE-2018-5742

RHSA-2019:0194

RHSA-2019_0194

Affected Products

Bind 9

Centos

Red Hat

References · 3

• https://osv.dev/vulnerability/CVE-2018-5742 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5742 · Security Note
• https://access.redhat.com/security/cve/cve-2018-5742 · Note