Select your cookie preferences

We use cookies and similar tools to enhance your experience, provide our services, deliver relevant advertising, and make improvements. Approved third parties also use these tools to help us deliver advertising and provide certain site features.

CVE-2018-5743

Public on 2019-06-25
Modified on 2019-07-25
Description

A flaw was found in the way bind implemented tunable which limited simultaneous TCP client connections. A remote attacker could use this flaw to exhaust the pool of file descriptors available to named, potentially affecting network connections and the management of files such as log files or zone journal files. In cases where the named process is not limited by OS-enforced per-process limits, this could additionally potentially lead to exhaustion of all available free file descriptors on that system.

Severity
Important
See what this means
CVSS v3 Base Score
8.6
See breakdown
Continue reading

Affected Packages

Platform Package Release Date Advisory
Amazon Linux 1 bind 2019-07-17 23:52 ALAS-2019-1244
Amazon Linux 2 - Core bind 2019-06-25 21:06 ALAS2-2019-1231

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NVD CVSSv2 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P
NVD CVSSv3 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H