Vulnetix
Try Vulnetix Request Demo
CVE-2018-10936 PUBLISHED

A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.

EPSS 0.85% · 74.7th percentile

Risk Scores

EPSS Score
0.85%
74.7th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:20.04:LTSlibpgjava0, 42.2.8-1, 42.2.9-1
Ubuntu:16.04:LTSlibpgjava0, 9.2-1002-1
Ubuntu:14.04:LTSlibpgjava0, 9.2-1002-1
Ubuntu:22.04:LTSlibpgjava42.3.3-1, 42.2.24-1, 42.3.1-1
Ubuntu:Pro:18.04:LTSlibpgjava9.4.1212-1, 0, 9.4.1212-1ubuntu0.1~esm1

Timeline

References

Open in Interactive Console →