Skip to content
Fencer Vulns
high 8.1

CVE-2018-10936 json

Moderate severity vulnerability that affects org.postgresql:pgjdbc-aggregate

published 2018-08-30 8 y ago modified 2026-06-17 4 mo ago also GHSA-568q-9fw5-28wf , EUVD-2018-0508

cvss
8.1
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.9%
EPSS 2.9% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.

Patch / fix

  • maven org.postgresql:pgjdbc-aggregate 42.2.5
  • postgresql postgresql_jdbc_driver 42.2.5
  • libpgjava Debian 14, Debian 13, Debian 12 42.2.5-1

debian advisories DEBIAN-CVE-2018-10936

  • susemanager Manager Server Module 4.0 4.0.32-3.46.1
  • bind-formula Manager Server Module 4.0 0.1.1603299886.60e4bcf-3.11.1
  • spacewalk-web Manager Server Module 4.0 4.0.25-3.36.1
  • spacewalk-java Manager Server Module 4.0 4.0.40-3.48.2
  • grafana-formula Manager Server Module 4.0 0.2.2-4.13.1
  • postgresql-jdbc Manager Server Module 4.0 42.2.10-3.3.1
  • spacewalk-admin Manager Server Module 4.0 4.0.12-3.15.1
  • susemanager-sls Manager Server Module 4.0 4.0.31-3.37.1

suse advisories SUSE-SU-2020:3466-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-10936 updated cvss 8.1

PostgreSQL: Postgres JDBC driver does not perform host name validation by default

  • Red Hat Enterprise Linux 6 postgresql-jdbc
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 7 postgresql-jdbc, postgresql-jdbc-javadoc Red Hat Enterprise Linux 8 postgresql-jdbc, postgresql-jdbc-javadoc
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Virtualization 4 postgresql-jdbc, postgresql-jdbc-javadoc
    affected: workaround, no fix planned “Will not fix”
  • Red Hat CloudForms Management Engine 5 postgresql94, postgresql94-libs, postgresql94-test, postgresql94-pltcl, postgresql94-plperl, postgresql94-server, +2 more Red Hat Ansible Tower 3 postgresql96 Red Hat Mobile Application Platform 4 millicore
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.87% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.0 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected packages

ecosystem package affected fixed in
maven org.postgresql:pgjdbc-aggregate
<42.2.5
42.2.5

Affected products

  • [UNKNOWN] PostgreSQL

Classification

Weakness
  • CWE-297 Improper Validation of Certificate with Host Mismatch

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.