CVE-2018-10936 in PostgreSQL and Red Hat Products
Published on August 30, 2018
A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.
Weakness Type
Improper Validation of Certificate with Host Mismatch
The software communicates with a host that provides a certificate, but the software does not properly ensure that the certificate is actually associated with that host.
Products Associated with CVE-2018-10936
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2018-10936 are published in these products:
Affected Versions
[UNKNOWN] PostgreSQL Version 42.2.5 is affected by CVE-2018-10936Exploit Probability
EPSS
0.89%
Percentile
75.27%
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.