CVE-2018-10936
Fixed in a distro release EPSS 3%CVSS 8.1
A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.
Products: postgresql_jdbc_driver, redhat enterprise_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.postgresql:pgjdbc-aggregate | 42.2.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libpgjava | 42.2.5-1 |
| Debian 13 | libpgjava | 42.2.5-1 |
| Debian 14 | libpgjava | 42.2.5-1 |
| SUSE Manager Server Module 4.0 | bind-formula | 0.1.1603299886.60e4bcf-3.11.1 |
| SUSE Manager Server Module 4.0 | grafana-formula | 0.2.2-4.13.1 |
| SUSE Manager Server Module 4.0 | postgresql-jdbc | 42.2.10-3.3.1 |
| SUSE Manager Server Module 4.0 | prometheus-exporters-formula | 0.7.5-3.16.1 |
| SUSE Manager Server Module 4.0 | prometheus-formula | 0.2.3-4.16.1 |
| SUSE Manager Server Module 4.0 | salt-netapi-client | 0.18.0-4.12.1 |
| SUSE Manager Server Module 4.0 | spacewalk-admin | 4.0.12-3.15.1 |
| SUSE Manager Server Module 4.0 | spacewalk-backend | 4.0.35-3.38.1 |
| SUSE Manager Server Module 4.0 | spacewalk-java | 4.0.40-3.48.2 |
| SUSE Manager Server Module 4.0 | spacewalk-web | 4.0.25-3.36.1 |
| SUSE Manager Server Module 4.0 | susemanager | 4.0.32-3.46.1 |
| SUSE Manager Server Module 4.0 | susemanager-schema | 4.0.23-3.32.1 |
| SUSE Manager Server Module 4.0 | susemanager-sls | 4.0.31-3.37.1 |
| Ubuntu 14.04 LTS | libpgjava | no fix |
| Ubuntu 16.04 LTS | libpgjava | no fix |
| Ubuntu 22.04 LTS | libpgjava | no fix |
| Ubuntu Pro 18.04 LTS | libpgjava | no fix |
| Ubuntu Pro 20.04 LTS | libpgjava | no fix |