PT-2018-10194 · Postgresql+2 · Postgresql-Jdbc+2

Pedro Sampaio · Published 2018-08-30 · Updated 2023-07-05 · CVE-2018-10936

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions postgresql-jdbc versions prior to 42.2.5

Description A weakness was found that could allow a man-in-the-middle attacker to masquerade as a trusted server. This occurs when an SSL Factory is provided without a host name verifier, allowing an attacker to provide a certificate for the wrong host, as long as it is signed by a trusted CA.

Recommendations For versions prior to 42.2.5, update to version 42.2.5 or later to resolve the issue. As a temporary workaround, consider providing a host name verifier to the driver to ensure the host name is checked.

Fix

Weakness Enumeration

CWE-297

Related Identifiers

ALT-PU-2023-8463

CVE-2018-10936

GHSA-568Q-9FW5-28WF

SUSE-SU-2020:3466-1

Affected Products

Alt Linux

Suse

Postgresql-Jdbc

References · 40

• https://osv.dev/vulnerability/UBUNTU-CVE-2018-10936 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10936 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-568q-9fw5-28wf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10936 · Security Note
• https://postgresql.org/about/news/1883 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-10936 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21724 · Security Note
• https://bdu.fstec.ru/vul/2022-00821 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2020:3466-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13692 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-10936 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-10936 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03872 · Security Note
• https://osv.dev/vulnerability/CVE-2018-10936 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10936 · Security Note