Skip to content
OpenAdvisories
Medium USN-3683-1 1 CVE

bind9 vulnerability

Published Jun 13, 2018 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Andrew Skalski discovered that Bind could incorrectly enable recursion
when the "allow-recursion" setting wasn't specified. This issue could
improperly permit recursion to all clients, contrary to expectations.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS bind9 1:9.11.3+dfsg-1ubuntu1.1

Vulnerabilities 1

  • Medium 5.3
    CVE-2018-5738 EPSS 11%

    Some versions of BIND can improperly permit recursive query service to unauthorized clients

    Change #4777 (introduced in October 2017) introduced an unforeseen issue in releases which were issued after that date, affecting which clients are permitted to make recursive queries to a BIND nameserver. The intended (and documented) behavior is that if an …

    ISC BIND 9 bind9 bind9 Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2018-5738