PT-2018-10194 · Postgresql+2 · Postgresql-Jdbc+2

Pedro Sampaio · Publicado 2018-08-30 · Atualizado 2023-07-05 · CVE-2018-10936

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions postgresql-jdbc versions prior to 42.2.5

Description A weakness was found that could allow a man-in-the-middle attacker to masquerade as a trusted server. This occurs when an SSL Factory is provided without a host name verifier, allowing an attacker to provide a certificate for the wrong host, as long as it is signed by a trusted CA.

Recommendations For versions prior to 42.2.5, update to version 42.2.5 or later to resolve the issue. As a temporary workaround, consider providing a host name verifier to the driver to ensure the host name is checked.

Correção

Enumeração de Fraquezas

CWE-297

Identificadores relacionados

ALT-PU-2023-8463

CVE-2018-10936

GHSA-568Q-9FW5-28WF

SUSE-SU-2020:3466-1

Produtos afetados

Alt Linux

Suse

Postgresql-Jdbc

Referências · 40

• https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-v7wg-cpwc-24m4 · Nota
• https://bugzilla.suse.com/1173199 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-10936 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2020-13692 · Nota
• https://bugzilla.suse.com/1144447 · Nota
• https://bugzilla.suse.com/1175876 · Nota
• https://ubuntu.com/security/CVE-2018-10936 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-568q-9fw5-28wf · Aviso do Fabricante
• https://bugzilla.suse.com/1176172 · Nota
• https://suse.com/support/update/announcement/2020/suse-su-20203466-1 · Nota
• https://suse.com/security/cve/CVE-2018-10936 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-10936 · Nota de Segurança
• https://bugzilla.suse.com/1178145 · Nota
• https://bugzilla.suse.com/1178195 · Nota
• https://postgresql.org/about/news/1883 · Aviso do Fabricante