Critical SSL Hostname Verification Bypass in libpgjava Package
Summary
UBUNTU-CVE-2018-10936: A weakness was found in postgresql-jdbc before version 42.2.5. Affects libpgjava versions 9.2-1002-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libpgjava package provides a JDBC driver for PostgreSQL, enabling Java applications to interact with PostgreSQL databases. It is widely used in enterprise applications for its robust performance and reliability. However, a vulnerability was discovered that compromises the security of SSL connections, potentially allowing attackers to impersonate trusted servers.
Vulnerability Detail
A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA. The CVSS score for this vulnerability is 8.1, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement a custom hostname verifier in your application to ensure that the hostname matches the certificate presented by the server. Here is an example of how to set a hostname verifier:
import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.HttpsURLConnection;
HostnameVerifier hv = new HostnameVerifier() { public boolean verify(String hostname, SSLSession session) {
return hostname.equals("expected.hostname.com");
}
};
HttpsURLConnection.setDefaultHostnameVerifier(hv);
Conclusion
The vulnerability in the libpgjava package poses a significant risk due to the potential for man-in-the-middle attacks. It is crucial for users to update to the latest patched version to mitigate this risk. Implementing a hostname verifier can serve as a temporary workaround while updates are applied.
See every vulnerability recorded for libpgjava →
FAQ
An attacker could impersonate a trusted server, potentially leading to data breaches or unauthorized access to sensitive information.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without requiring signup.
Versions of libpgjava prior to 42.2.5 are affected by this vulnerability.
Yes, a patched version is available. It is recommended to update to version 42.2.10-1ubuntu0.1~esm1 or later.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for libpgjava.
