Fluid Attacks Database

Description

Affected versions of this package are vulnerable to Man-in-the-Middle (MitM). It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
maven	org.postgresql:pgjdbc-aggregate	>=0 <42.2.5	42.2.5
debian 11	libpgjava	>=0 <42.2.5-1	42.2.5-1
debian 13	libpgjava	>=0 <42.2.5-1	42.2.5-1
debian 14	libpgjava	>=0 <42.2.5-1	42.2.5-1
debian 12	libpgjava	>=0 <42.2.5-1	42.2.5-1
maven	org.postgresql:postgresql	>=0 <42.2.5	-
rpm rhel6	postgresql-jdbc	-	-
rpm rhel7	postgresql-jdbc	-	-
rpm rhel8	postgresql-jdbc	-	-

Aliases

1. CVE-2018-109362. NVD-2018-109363. OSV-2018-109364. OSV-DEBIAN-2018-109365. GHSA-568q-9fw5-28wf6. GCVE-2018-109367. SECURITY-TRACKER-CVE-2018-109368. DB-CVE-2018-10936

References

1. https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-109362. https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E3. https://www.postgresql.org/about/news/18834. http://www.securityfocus.com/bid/1052205. https://github.com/tafamace/CVE-2018-10936

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.