CVE-2018-10936
HIGH 8.1EPSS 2.9%
A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.
- Affected
- [UNKNOWN] · PostgreSQL
- CVSS v3.0 NVD
- 8.1 HIGH
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 6.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P - EPSS
- 2.91% chance of exploitation in the next 30 days, 87th percentile
- Published
- 2018-08-30
- Updated
- 2024-08-05
Proof-of-concept exploits (1)
- tafamace/CVE-2018-109360★ · 2018-11-19
Security advisories
- https://www.postgresql.org/about/news/1883
- http://www.securityfocus.com/bid/105220
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10936
- advisories/GHSA-568q-9fw5-28wf