CVE-2018-5745 — An assertion failure can occur if a trust anchor rolls over to an unsupported key algorithm when using managed-keys

Back Back to CVE browser

MEDIUM

An assertion failure can occur if a trust anchor rolls over to an unsupported key algorithm when using managed-keys

Published Oct 9, 2019

4.9

MEDIUM

CVSS 3.1

EPSS 2.28%

Description

"managed-keys" is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which operators configure for use in DNSSEC validation. Due to an error in the managed-keys feature it is possible for a BIND server which uses managed-keys to exit due to an assertion failure if, during key rollover, a trust anchor's keys are replaced with keys which use an unsupported algorithm. Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5745.

Affected products

Vendor ISC Product BIND 9 Default
n/a
- Version
  BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5745.
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ISC

BIND 9

n/a

Version	Status	Constraints
BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5745.	affected	-

Red Hat Enterprise Linux 7

bind-32:9.11.4-16.P2.el7

Fixed · RHSA-2020:1061
Red Hat Enterprise Linux 8

bind-32:9.11.4-26.P2.el8

Fixed · RHSA-2019:3552
Red Hat Enterprise Linux 8

bind-32:9.11.4-26.P2.el8

Fixed · RHSA-2019:3552
Red Hat Enterprise Linux 5

bind

Not affected
Red Hat Enterprise Linux 5

bind97

Not affected
Red Hat Enterprise Linux 6

bind

Will not fix

Product	Package	State	Advisory
Red Hat Enterprise Linux 7	bind-32:9.11.4-16.P2.el7	Fixed	RHSA-2020:1061
Red Hat Enterprise Linux 8	bind-32:9.11.4-26.P2.el8	Fixed	RHSA-2019:3552
Red Hat Enterprise Linux 8	bind-32:9.11.4-26.P2.el8	Fixed	RHSA-2019:3552
Red Hat Enterprise Linux 5	bind	Not affected	n/a
Red Hat Enterprise Linux 5	bind97	Not affected	n/a
Red Hat Enterprise Linux 6	bind	Will not fix	n/a

Remediation

Vendor solution

Upgrade to a version of BIND containing a fix preventing the assertion failure.

>= BIND 9.11.5-P4 >= BIND 9.12.3-P4

BIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers.

>= BIND 9.11.5-S5

Metrics

2.28% 0.02282

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.02282

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v5

Table of values (13 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	2.28% (0.02282)	82.53th	v5 (v2026.06.15)
Jun 15, 2026	2.57% (0.02571)	83.08th	v5 (v2026.06.15)
Jul 20, 2024	0.08% (0.00081)	35.19th	v3 (v2023.03.01)
Jun 21, 2024	0.08% (0.00081)	34.95th	v3 (v2023.03.01)
Mar 7, 2023	0.08% (0.00081)	32.95th	v3 (v2023.03.01)
Mar 6, 2023	0.89% (0.00885)	27.89th	v2 (v2022.01.01)
Sep 10, 2022	0.89% (0.00885)	26.24th	v2 (v2022.01.01)
Apr 1, 2022	0.89% (0.00885)	24.24th	v2 (v2022.01.01)
Feb 4, 2022	0.89% (0.00885)	10.50th	v2 (v2022.01.01)
Feb 3, 2022	0.62% (0.00624)	17.80th	v1
Jan 6, 2022	0.62% (0.00624)	17.24th	v1
Sep 1, 2021	0.62% (0.00624)	45.04th	v1
Apr 14, 2021	0.62% (0.00624)	0.00th	v1

Weaknesses (2)

CWE-327

Broken Crypto Algorithm

CWE-617

References (6)

https://access.redhat.com/errata/RHSA-2019:3552
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2018-5745
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1679303
Issue Tracking
https://kb.isc.org/docs/cve-2018-5745
x_refsource_CONFIRMThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-5745
https://www.cve.org/CVERecord?id=CVE-2018-5745

Link	Providers	Tags
https://access.redhat.com/errata/RHSA-2019:3552		vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2018-5745		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1679303		Issue Tracking
https://kb.isc.org/docs/cve-2018-5745		x_refsource_CONFIRMThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-5745
https://www.cve.org/CVERecord?id=CVE-2018-5745