CVE-2022-1183: isc bind Reachable Assertion
Vulnerability summary
CVE-2022-1183 is a high (CVSS 7.5) Reachable Assertion vulnerability in isc bind. EPSS estimates a 6.27% chance of exploitation in the next 30 days, higher than 93.4% of scored vulnerabilities.
Timeline
- 19-05-2022PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those that include a reference to http within the listen-on statements in their named.conf. TLS is used by both DNS over TLS (DoT) and DNS over HTTPS (DoH), but configurations using DoT alone are unaffected. Affects BIND 9.18.0 -> 9.18.2 and version 9.19.0 of the BIND 9.19 development branch.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
6.27%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
+0.09 pp
From 6.17% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Netapp5 products
Isc2 products
Debian1 product
- bind9< 1:9.18.3-1
Opensuse1 product
- bind&distro=openSUSE Tumbleweed< 9.18.3-1.1
Ubuntu1 product
- bind9< 1:9.18.1-1ubuntu1.1
5 vendors · 10 products
