CVE catalog

CVE-2018-10936

libpgjava: CVE-2018-10936

Severity: High · CVSS 8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Aug 27, 2018, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 2.91% · Oct 25, 2026

A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libpgjava	sid	`42.7.14-1`	fixed
Debian	libpgjava	forky	`42.7.14-1`	fixed
Debian	libpgjava	trixie	`42.7.7-1`	fixed
Debian	libpgjava	bookworm	`42.5.5-0+deb12u1`	fixed
Suse	bind-formula	manager server module 4.0	`0.1.1603299886.60e4bcf-3.11.1`	fixed
Suse	grafana-formula	manager server module 4.0	`0.2.2-4.13.1`	fixed
Suse	postgresql-jdbc	manager server module 4.0	`42.2.10-3.3.1`	fixed
Suse	prometheus-exporters-formula	manager server module 4.0	`0.7.5-3.16.1`	fixed
Suse	prometheus-formula	manager server module 4.0	`0.2.3-4.16.1`	fixed
Suse	salt-netapi-client	manager server module 4.0	`0.18.0-4.12.1`	fixed
Suse	spacewalk-admin	manager server module 4.0	`4.0.12-3.15.1`	fixed
Suse	spacewalk-backend	manager server module 4.0	`4.0.35-3.38.1`	fixed
Suse	spacewalk-java	manager server module 4.0	`4.0.40-3.48.2`	fixed
Suse	spacewalk-web	manager server module 4.0	`4.0.25-3.36.1`	fixed
Suse	susemanager	manager server module 4.0	`4.0.32-3.46.1`	fixed
Suse	susemanager-schema	manager server module 4.0	`4.0.23-3.32.1`	fixed
Suse	susemanager-sls	manager server module 4.0	`4.0.31-3.37.1`	fixed
Ubuntu	libpgjava	14.04	`9.2-1002-1`	vulnerable
Ubuntu	libpgjava	16.04	`9.2-1002-1`	vulnerable
Ubuntu	libpgjava	pro	`42.2.6-1`	vulnerable
Ubuntu	libpgjava	pro	`42.2.8-1`	vulnerable
Ubuntu	libpgjava	pro	`42.2.9-1`	vulnerable
Ubuntu	libpgjava	pro	`42.2.10-1`	vulnerable
Ubuntu	libpgjava	pro	`42.2.10-1ubuntu0.1~esm1`	vulnerable
Ubuntu	libpgjava	22.04	`42.2.23-1`	vulnerable
Ubuntu	libpgjava	22.04	`42.2.24-1`	vulnerable
Ubuntu	libpgjava	22.04	`42.3.1-1`	vulnerable
Ubuntu	libpgjava	22.04	`42.3.2-1`	vulnerable
Ubuntu	libpgjava	22.04	`42.3.3-1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libpgjava	source	sid	`42.2.5-1`	not yet assigned	Not reported	Not reported
Debian	libpgjava	source	forky	`42.2.5-1`	not yet assigned	Not reported	Not reported
Debian	libpgjava	source	trixie	`42.2.5-1`	not yet assigned	Not reported	Not reported
Debian	libpgjava	source	bookworm	`42.2.5-1`	not yet assigned	Not reported	Not reported
Suse	bind-formula	rpm	manager server module 4.0	`0.1.1603299886.60e4bcf-3.11.1`	Not reported	SUSE-SU-2020:3466-1	Not reported
Suse	grafana-formula	rpm	manager server module 4.0	`0.2.2-4.13.1`	Not reported	SUSE-SU-2020:3466-1	Not reported
Suse	postgresql-jdbc	rpm	manager server module 4.0	`42.2.10-3.3.1`	Not reported	SUSE-SU-2020:3466-1	Not reported
Suse	prometheus-exporters-formula	rpm	manager server module 4.0	`0.7.5-3.16.1`	Not reported	SUSE-SU-2020:3466-1	Not reported
Suse	prometheus-formula	rpm	manager server module 4.0	`0.2.3-4.16.1`	Not reported	SUSE-SU-2020:3466-1	Not reported
Suse	salt-netapi-client	rpm	manager server module 4.0	`0.18.0-4.12.1`	Not reported	SUSE-SU-2020:3466-1	Not reported
Suse	spacewalk-admin	rpm	manager server module 4.0	`4.0.12-3.15.1`	Not reported	SUSE-SU-2020:3466-1	Not reported
Suse	spacewalk-backend	rpm	manager server module 4.0	`4.0.35-3.38.1`	Not reported	SUSE-SU-2020:3466-1	Not reported
Suse	spacewalk-java	rpm	manager server module 4.0	`4.0.40-3.48.2`	Not reported	SUSE-SU-2020:3466-1	Not reported
Suse	spacewalk-web	rpm	manager server module 4.0	`4.0.25-3.36.1`	Not reported	SUSE-SU-2020:3466-1	Not reported
Suse	susemanager	rpm	manager server module 4.0	`4.0.32-3.46.1`	Not reported	SUSE-SU-2020:3466-1	Not reported
Suse	susemanager-schema	rpm	manager server module 4.0	`4.0.23-3.32.1`	Not reported	SUSE-SU-2020:3466-1	Not reported
Suse	susemanager-sls	rpm	manager server module 4.0	`4.0.31-3.37.1`	Not reported	SUSE-SU-2020:3466-1	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libpostgresql-jdbc-java]Fixed
Source package: [libpgjava]
Details (2)
- 42.5.5-0+deb12u1 · all · bookworm
  Fixed · Fixed: 42.2.5-1
  dsa · libpgjava · debian · bookworm; dsa · libpgjava · debian · 12
- 42.5.5-0+deb12u1 · all · bookworm
  Fixed · Fixed: 42.2.5-1
  dsa · libpgjava · debian · bookworm; dsa · libpgjava · debian · 12
[libpostgresql-jdbc-java-doc]Fixed
Source package: [libpgjava]
Details (2)
- 42.5.5-0+deb12u1 · all · bookworm
  Fixed · Fixed: 42.2.5-1
  dsa · libpgjava · debian · bookworm; dsa · libpgjava · debian · 12
- 42.5.5-0+deb12u1 · all · bookworm
  Fixed · Fixed: 42.2.5-1
  dsa · libpgjava · debian · bookworm; dsa · libpgjava · debian · 12

[Debian 13 (Trixie)]

[libpostgresql-jdbc-java]Fixed
Source package: [libpgjava]
Details (2)
- 42.7.7-1 · all · trixie
  Fixed · Fixed: 42.2.5-1
  dsa · libpgjava · debian · 13
- 42.7.7-1 · all · trixie
  Fixed · Fixed: 42.2.5-1
  dsa · libpgjava · debian · 13

Observed: Oct 23, 2026, 5:33:30 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]