CVE-2018-10936 Moderate severity vulnerability that affects org.postgresql:pgjdbc-aggregate
Man-in-the-middle attackers can masquerade as trusted servers by bypassing hostname verification in the PostgreSQL JDBC driver.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-10936?
CVE-2018-10936 is a high-severity vulnerability in Redhat Enterprise Linux, published on 30 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.
Weakness: CWE-297
Which versions are affected by CVE-2018-10936?
2 open source packages ship an affected version, including org.postgresql:pgjdbc-aggregate. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.postgresql:pgjdbc-aggregate Maven | All versions | 42.2.5 |
org.postgresql:pgjdbc-aggregate Maven | All versions | 42.2.5 |
Products include Postgresql Postgresql Jdbc Driver, Redhat Enterprise Linux.
How do I fix CVE-2018-10936?
Upgrade org.postgresql:pgjdbc-aggregate to 42.2.5 or later.
Is CVE-2018-10936 being exploited?
There is no known exploitation of CVE-2018-10936 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2026-54291 Silent channel-binding authentication downgrade via unsupported certificate algorithms
- CVE-2025-49146 pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration
- CVE-2026-42198 pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS
Sources
Also known as DEBIAN-CVE-2018-10936, GHSA-568q-9fw5-28wf, UBUNTU-CVE-2018-10936.