CVE Feed

    Dashboard / CVE / CVE-2018-10936

    CVE-2018-10936

    A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.

    Published:Aug 27, 2018
    Last Modified:Nov 21, 2024
    EPS:Aug 30, 2018
    EPSS Score:0.01346
    CVSS Score:8.1

    Affected Products

    Vendor
    Postgresql
    Product
    Postgresql Jdbc Driver
    Vendor
    Redhat
    Product
    Enterprise Linux

    Exploits

    https://github.com/dawetmaster/CVE-2018-10936-pgjdbc-vulnerablehttps://github.com/tafamace/CVE-2018-10936

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-42198 (CVSS 7.5) — pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vuln…
    CVE-2025-49146 (CVSS 8.2) — pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver…
    CVE-2024-1597 (CVSS 10) — pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this i…
    CVE-2022-41946 (CVSS 4.7) — pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either `Prepa…
    CVE-2022-31197 (CVSS 7.1) — PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using stand…
    CVE-2022-26520 (CVSS 9.8) — In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.File…
    CVE-2022-21724 (CVSS 7) — pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql data…
    CVE-2020-13692 (CVSS 7.7) — PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.…
    CVE-2012-1618 (CVSS 7.5) — Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "stand…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High