CVE-2018-10936: PostgreSQL Jdbc Driver

High severity, CVSS 8.1. EPSS: 2.9% chance of exploitation in the next 30 days.

A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.

Affected products

• PostgreSQL PostgreSQL Jdbc Driver: before 42.2.5 (fixed in 42.2.5)
• Red Hat Enterprise Linux: version 6.0 only; version 7.0 only

Published 2018-08-30. Last modified 2026-06-17.