CVE-2018-10936: Vulnerability in org.postgresql:pgjdbc-aggregate
Summary
CVE-2018-10936: Moderate severity vulnerability that affects org.postgresql:pgjdbc-aggregate. Affects org.postgresql:pgjdbc-aggregate versions < 42.2.5. Fixed in 42.2.5. How to fix ↓
Also tracked for
- libpgjava · Debian:11
The same CVE-2018-10936 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.postgresql:pgjdbc-aggregate is a Maven package that provides JDBC drivers for connecting to PostgreSQL databases. It allows Java applications to interact with PostgreSQL databases and execute SQL queries. This package is vulnerable to a moderate severity vulnerability.
Vulnerability Detail
The vulnerability (CVE-2018-10936) in org.postgresql:pgjdbc-aggregate allows an attacker to masquerade as a trusted server by providing a certificate for the wrong host, as long as it is signed by a trusted CA. This is possible because the package does not check the host name if a host name verifier is not provided to the driver. A man-in-the-middle attacker could exploit this weakness and intercept sensitive data or perform unauthorized actions.
How To Fix
Minimum fixed version
42.2.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a workaround is to manually implement host name verification in the application code. This can be done by providing a host name verifier to the driver that validates the server's host name against the expected host name. Here is an example of how to implement this workaround in Java:
import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.SSLSession;
public class CustomHostnameVerifier implements HostnameVerifier {
@Override
public boolean verify(String hostname, SSLSession session) {
// Implement custom host name verification logic
return true; // Return true if the host name is valid
}
}
// Set the custom host name verifier
CustomHostnameVerifier verifier = new CustomHostnameVerifier();
DriverManager.getConnection(url, properties, verifier);
Conclusion
In conclusion, org.postgresql:pgjdbc-aggregate is vulnerable to a moderate severity vulnerability that allows a man-in-the-middle attacker to impersonate a trusted server. It is recommended to update the package to version 42.2.5 or later to fix this vulnerability. If immediate update is not possible, implementing custom host name verification in the application code can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.postgresql:pgjdbc-aggregate →
FAQ
The vulnerability allows a man-in-the-middle attacker to impersonate a trusted server and potentially intercept sensitive data or perform unauthorized actions.
Versions prior to 42.2.5 are affected by this vulnerability.
Yes, a workaround is to implement custom host name verification in the application code.
To fix the vulnerability, update the org.postgresql:pgjdbc-aggregate package to version 42.2.5 or later.
You can find more information about this vulnerability in the GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-568q-9fw5-28wf/GHSA-568q-9fw5-28wf.json
