CVE-2018-5745 — An assertion failure can occur if a trust anchor rolls over to an unsupported key algorithm when using managed-keys

Description

"managed-keys" is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which operators configure for use in DNSSEC validation. Due to an error in the managed-keys feature it is possible for a BIND server which uses managed-keys to exit due to an assertion failure if, during key rollover, a trust anchor's keys are replaced with keys which use an unsupported algorithm. Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5745.

Affected products

Vendor	Product	Affected	Fixed
ISC	BIND 9	BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5…	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	bind9	1:9.11.5.P4+dfsg-1	—
Debian 13	bind9	1:9.11.5.P4+dfsg-1	—
Debian 12	bind9	1:9.11.5.P4+dfsg-1	—
Debian 9	bind9	1:9.10.3.dfsg.P4-12.3+deb9u5	DSA-4440-1
Debian 8	bind9	1:9.9.5.dfsg-9+deb8u17	DLA-1697-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	bind9	1:9.11.3+dfsg-1ubuntu1.5	USN-3893-1
Ubuntu 16.04 LTS	bind9	1:9.10.3.dfsg.P4-8ubuntu1.12	USN-3893-1
Ubuntu 14.04 LTS	bind9	1:9.9.5.dfsg-3ubuntu0.19	USN-3893-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 8	bind +16	32:9.11.4-26.P2.el8	RHSA-2019:3552
RHEL 7	bind +15	32:9.11.4-16.P2.el7	RHSA-2020:1061

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP1	bind	9.11.2-12.11.2	SUSE-SU-2019:1407-1
SLES 15	bind	9.11.2-12.11.2	SUSE-SU-2019:1407-1
SLES 12 SP4	bind	9.11.2-3.10.1	SUSE-SU-2019:2502-1
SLES 12	bind	9.9.9P1-28.42.1	SUSE-SU-2019:1449-1
SLES 11 SP4	bind	9.9.6P1-0.51.15.4	SUSE-SU-2019:14074-1

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 12 SP4	bind	9.11.2-3.10.1	SUSE-SU-2019:2502-1
SUSE Linux Enterprise Point of Sale 11 SP3	bind	9.9.6P1-0.51.15.4	SUSE-SU-2019:14074-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	bind	9.16.20-1.4	openSUSE-SU-2024:10650-1
openSUSE Leap 15.1	bind	9.11.2-lp151.11.3.1	openSUSE-SU-2019:1533-1
openSUSE Leap 15.0	bind	9.11.2-lp151.11.3.1	openSUSE-SU-2019:1533-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	bind	9.12.3_p4-r0	—
Alpine v3.23	bind	9.12.3_p4-r0	—
Alpine v3.22	bind	9.12.3_p4-r0	—
Alpine v3.21	bind	9.12.3_p4-r0	—
Alpine v3.20	bind	9.12.3_p4-r0	—

Show 14 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	bind	9.12.3_p4-r0	—
Alpine v3.18	bind	9.12.3_p4-r0	—
Alpine v3.17	bind	9.12.3_p4-r0	—
Alpine v3.16	bind	9.12.3_p4-r0	—
Alpine v3.15	bind	9.12.3_p4-r0	—
Alpine v3.14	bind	9.12.3_p4-r0	—
Alpine v3.13	bind	9.12.3_p4-r0	—
Alpine v3.12	bind	9.12.3_p4-r0	—
Alpine v3.11	bind	9.12.3_p4-r0	—
Alpine v3.10	bind	9.12.3_p4-r0	—
Alpine v3.9	bind	9.12.3_p4-r0	—
Alpine v3.8	bind	9.12.3_p4-r0	—
Alpine v3.7	bind	9.11.5_p4-r0	—
Alpine v3.6	bind	9.11.5_p4-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2	bind +15	32:9.11.4-9.P2.amzn2.0.4	ALAS2-2020-1441

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 8	bind +16	32:9.11.4-26.P2.el8	ELSA-2019-3552
Oracle Linux 7	bind +15	32:9.11.4-16.P2.el7	ELSA-2020-1061

Advisories 15

RHSA-2020:1061 Red Hat Security Advisory: bind security and bug fix update Red Hat Security Advisories (RHSA) · Sep 2, 2026
RHSA-2019:3552 Red Hat Security Advisory: bind security and bug fix update Red Hat Security Advisories (RHSA) · Sep 2, 2026
USN-3893-1 bind9 vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
DSA-4440-1 bind9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-1697-1 bind9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
SUSE-SU-2019:14074-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2019:1407-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2019:1533-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2019:1449-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2019:2502-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:10650-1 bind-9.16.20-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2025-1194 Internet Systems Consortium BIND: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 29, 2025
ALAS2-2020-1441 Moderate: bind security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 1, 2020
ELSA-2020-1061 Moderate: bind security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Apr 6, 2020
ELSA-2019-3552 Low: bind security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 14, 2019

References

https://kb.isc.org/docs/cve-2018-5745
RHSA-2019:3552 vendor-advisory

CNA	v3.0	4.9
EUVD	v3.0	4.9