CVE-2018-10936: postgresql postgresql_jdbc_driver
Vulnerability summary
CVE-2018-10936 is a high (CVSS 8.1) vulnerability in postgresql postgresql_jdbc_driver. EPSS estimates a 2.91% chance of exploitation in the next 30 days, higher than 86.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 30-08-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.
CVSS metrics
5 scores · 4 sources · 2 versions- NVDNIST8.1HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.91%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
0.00 pp
From 2.91% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
[unknown]1 product
- postgresql42.2.5
Debian1 product
- libpgjava< 42.2.5-1
Org.postgresql1 product
- pgjdbc-aggregate< 42.2.5
Postgresql1 product
- postgresql_jdbc_driver< 42.2.5
Redhat1 product
- enterprise_linuxEOL6.0 | 7.0
Ubuntu1 product
- libpgjavaAll versions (No fix recorded)
6 vendors · 6 products
References
11 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10936X Refsource CONFIRMIssue TrackingMitigationThird Party AdvisoryWEB
