{"id":"ALPINE-CVE-2018-5738","details":"Change #4777 (introduced in October 2017) introduced an unforeseen issue in releases which were issued after that date, affecting which clients are permitted to make recursive queries to a BIND nameserver. The intended (and documented) behavior is that if an operator has not specified a value for the \"allow-recursion\" setting, it SHOULD default to one of the following: none, if \"recursion no;\" is set in named.conf; a value inherited from the \"allow-query-cache\" or \"allow-query\" settings IF \"recursion yes;\" (the default for that setting) AND match lists are explicitly set for \"allow-query-cache\" or \"allow-query\" (see the BIND9 Administrative Reference Manual section 6.2 for more details); or the intended default of \"allow-recursion {localhost; localnets;};\" if \"recursion yes;\" is in effect and no values are explicitly set for \"allow-query-cache\" or \"allow-query\". However, because of the regression introduced by change #4777, it is possible when \"recursion yes;\" is in effect and no match list values are provided for \"allow-query-cache\" or \"allow-query\" for the setting of \"allow-recursion\" to inherit a setting of all hosts from the \"allow-query\" setting default, improperly permitting recursion to all clients. Affects BIND 9.9.12, 9.10.7, 9.11.3, 9.12.0-\u003e9.12.1-P2, the development release 9.13.0, and also releases 9.9.12-S1, 9.10.7-S1, 9.11.3-S1, and 9.11.3-S2 from BIND 9 Supported Preview Edition.","modified":"2026-06-09T21:31:28.644717513Z","published":"2019-01-16T20:29:00.907Z","upstream":["CVE-2018-5738"],"references":[{"type":"ADVISORY","url":"https://security.alpinelinux.org/vuln/CVE-2018-5738"}],"affected":[{"package":{"name":"bind","ecosystem":"Alpine:v3.10","purl":"pkg:apk/alpine/bind?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.12.2_p1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-5738.json"}},{"package":{"name":"bind","ecosystem":"Alpine:v3.11","purl":"pkg:apk/alpine/bind?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.12.2_p1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-5738.json"}},{"package":{"name":"bind","ecosystem":"Alpine:v3.12","purl":"pkg:apk/alpine/bind?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.12.2_p1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-5738.json"}},{"package":{"name":"bind","ecosystem":"Alpine:v3.13","purl":"pkg:apk/alpine/bind?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.12.2_p1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-5738.json"}},{"package":{"name":"bind","ecosystem":"Alpine:v3.14","purl":"pkg:apk/alpine/bind?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.12.2_p1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-5738.json"}},{"package":{"name":"bind","ecosystem":"Alpine:v3.15","purl":"pkg:apk/alpine/bind?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.12.2_p1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-5738.json"}},{"package":{"name":"bind","ecosystem":"Alpine:v3.16","purl":"pkg:apk/alpine/bind?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.12.2_p1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-5738.json"}},{"package":{"name":"bind","ecosystem":"Alpine:v3.17","purl":"pkg:apk/alpine/bind?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.12.2_p1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-5738.json"}},{"package":{"name":"bind","ecosystem":"Alpine:v3.18","purl":"pkg:apk/alpine/bind?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.12.2_p1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-5738.json"}},{"package":{"name":"bind","ecosystem":"Alpine:v3.19","purl":"pkg:apk/alpine/bind?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.12.2_p1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-5738.json"}},{"package":{"name":"bind","ecosystem":"Alpine:v3.20","purl":"pkg:apk/alpine/bind?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.12.2_p1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-5738.json"}},{"package":{"name":"bind","ecosystem":"Alpine:v3.21","purl":"pkg:apk/alpine/bind?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.12.2_p1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-5738.json"}},{"package":{"name":"bind","ecosystem":"Alpine:v3.22","purl":"pkg:apk/alpine/bind?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.12.2_p1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-5738.json"}},{"package":{"name":"bind","ecosystem":"Alpine:v3.23","purl":"pkg:apk/alpine/bind?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.12.2_p1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-5738.json"}},{"package":{"name":"bind","ecosystem":"Alpine:v3.24","purl":"pkg:apk/alpine/bind?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.12.2_p1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-5738.json"}},{"package":{"name":"bind","ecosystem":"Alpine:v3.6","purl":"pkg:apk/alpine/bind?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.11.5_p4-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-5738.json"}},{"package":{"name":"bind","ecosystem":"Alpine:v3.7","purl":"pkg:apk/alpine/bind?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.11.5_p4-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-5738.json"}},{"package":{"name":"bind","ecosystem":"Alpine:v3.9","purl":"pkg:apk/alpine/bind?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.12.2_p1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-5738.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}