SSL Host Name Verification Bypass in libpgjava - CVE-2018-10936
Summary
CVE-2018-10936: A weakness was found in postgresql-jdbc before version 42.2.5. Affects libpgjava across 2 version ranges.
< 42.2.5-1
< a1a5ae4f2283d4557f36756d1a0228310a3acccb
Fixed in 42.2.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libpgjava is a JDBC driver for PostgreSQL, enabling Java applications to connect to PostgreSQL databases. It provides essential functionalities for database interaction, including executing SQL queries and managing connections. However, prior to version 42.2.5, libpgjava had a critical vulnerability that allowed SSL connections to be established without proper host name verification, potentially exposing users to man-in-the-middle attacks.
Vulnerability Detail
A weakness was found in postgresql-jdbc before version 42.2.5, where it was possible to provide an SSL Factory without checking the host name if a host name verifier was not supplied to the driver. This oversight could allow a man-in-the-middle attacker to impersonate a trusted server by presenting a certificate for an incorrect host, provided that the certificate was signed by a trusted Certificate Authority (CA). The vulnerability has a CVSS score of 8.1, indicating a high severity level, and it poses significant risks to data integrity and confidentiality.
How To Fix
Minimum fixed version
42.2.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libpgjavaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider implementing a custom host name verifier in your application to ensure that SSL connections are validated against expected host names. This can be done by configuring the SSL connection properties in your JDBC connection string. Example code snippet:
System.setProperty("javax.net.ssl.trustStore", "/path/to/truststore.jks");
System.setProperty("javax.net.ssl.trustStorePassword", "password");
This approach, however, does not replace the need for an upgrade and should only be a temporary measure.
Conclusion
CVE-2018-10936 presents a significant security risk for applications using the libpgjava JDBC driver prior to version 42.2.5. Users are strongly encouraged to upgrade to the latest version to ensure secure SSL connections and protect against potential man-in-the-middle attacks. Additionally, utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for libpgjava →
FAQ
CVE-2018-10936 is a vulnerability in the libpgjava JDBC driver that allows SSL connections without proper host name verification, potentially leading to man-in-the-middle attacks.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file, like package-lock.json, to check for vulnerabilities.
If exploited, this vulnerability could allow attackers to intercept and manipulate data transmitted between your application and the PostgreSQL database, compromising data integrity and confidentiality.
Yes, you can implement a custom host name verifier in your application to validate SSL connections, but this should only be a temporary workaround until an upgrade can be performed.
It is recommended to upgrade to libpgjava version 42.2.5 or later to fully mitigate this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for libpgjava.
