Detections
Analytics

Alpine: multiple bind packages: security update to 9.12.2_p1-r0

high Tenable Self-Hosted Container Security Plugin ID 423739

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - Change #4777 (introduced in October 2017) introduced an unforeseen issue in releases which were issued
 after that date, affecting which clients are permitted to make recursive queries to a BIND nameserver. The
 intended (and documented) behavior is that if an operator has not specified a value for the "allow-
 recursion" setting, it SHOULD default to one of the following: none, if "recursion no;" is set in
 named.conf; a value inherited from the "allow-query-cache" or "allow-query" settings IF "recursion yes;"
 (the default for that setting) AND match lists are explicitly set for "allow-query-cache" or "allow-query"
 (see the BIND9 Administrative Reference Manual section 6.2 for more details); or the intended default of
 "allow-recursion {localhost; localnets;};" if "recursion yes;" is in effect and no values are explicitly
 set for "allow-query-cache" or "allow-query". However, because of the regression introduced by change
 #4777, it is possible when "recursion yes;" is in effect and no match list values are provided for "allow-
 query-cache" or "allow-query" for the setting of "allow-recursion" to inherit a setting of all hosts from
 the "allow-query" setting default, improperly permitting recursion to all clients. Affects BIND 9.9.12,
 9.10.7, 9.11.3, 9.12.0->9.12.1-P2, the development release 9.13.0, and also releases 9.9.12-S1, 9.10.7-S1,
 9.11.3-S1, and 9.11.3-S2 from BIND 9 Supported Preview Edition. (CVE-2018-5738)

 - "deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end
 users against DNS rebinding attacks, a potential method of circumventing the security model used by client
 browsers. However, a defect in this feature makes it easy, when the feature is in use, to experience an
 assertion failure in name.c. Affects BIND 9.7.0->9.8.8, 9.9.0->9.9.13, 9.10.0->9.10.8, 9.11.0->9.11.4,
 9.12.0->9.12.2, 9.13.0->9.13.2. (CVE-2018-5740)

See Also

https://security.alpinelinux.org/vuln/CVE-2018-5738

https://security.alpinelinux.org/vuln/CVE-2018-5740

Plugin Details

Severity: High

ID: 423739

Version: Revision 1.7

Type: Local

Published: 4/4/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2018-5738

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 5/18/2018

Reference Information

CVE: CVE-2018-5738, CVE-2018-5740

BID: 105055

IAVA: 2018-A-0255-S, 2018-A-0303-S