CVE-2018-10936
HIGHpostgresql-jdbc <42.2.5 - SSL Man-In-The-Middle
Title source: llmDescription
A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.
Exploits (3)
nomisec
WRITEUP
by dawetmaster · poc
https://github.com/dawetmaster/CVE-2018-10936-pgjdbc-vulnerable
nomisec
WRITEUP
by andikahilmy · poc
https://github.com/andikahilmy/CVE-2018-10936-pgjdbc-vulnerable
References (4)
Scores
CVSS v3
8.1
EPSS
0.0085
EPSS Percentile
74.9%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-297
Status
published
Products (4)
org.postgresql/pgjdbc-aggregate
0 - 42.2.5Maven
postgresql/postgresql_jdbc_driver
< 42.2.5
redhat/enterprise_linux
6.0
redhat/enterprise_linux
7.0
Published
Aug 30, 2018
Tracked Since
Feb 18, 2026