CVSS: 7.5EPSS: 39%CPEs: 26EXPL: 1CVE-2018-5740 – A flaw in the "deny-answer-aliases" feature can cause an assertion failure in named
https://notcve.org/view.php?id=CVE-2018-5740
28 Aug 2018 — "deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes it easy, when the feature is in use, to experience an assertion failure in name.c. Affects BIND 9.7.0->9.8.8, 9.9.0->9.9.13, 9.10.0->9.10.8, 9.11.0->9.11.4, 9.12.0->9.12.2, 9.13.0->9.13.2. "deny-answer-aliases" es una característica poco utilizada que ... • https://github.com/sischkg/cve-2018-5740 • CWE-617: Reachable Assertion •
CVSS: 7.5EPSS: 1%CPEs: 18EXPL: 0CVE-2018-5738 – Some versions of BIND can improperly permit recursive query service to unauthorized clients
https://notcve.org/view.php?id=CVE-2018-5738
13 Jun 2018 — Change #4777 (introduced in October 2017) introduced an unforeseen issue in releases which were issued after that date, affecting which clients are permitted to make recursive queries to a BIND nameserver. The intended (and documented) behavior is that if an operator has not specified a value for the "allow-recursion" setting, it SHOULD default to one of the following: none, if "recursion no;" is set in named.conf; a value inherited from the "allow-query-cache" or "allow-query" settings IF "recursion yes;" ... • http://www.securitytracker.com/id/1041115 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •