Moderate severity vulnerability that affects org.postgresql:pgjdbc-aggregate
A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.postgresql:pgjdbc-aggregate | < 42.2.5 | 42.2.5 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-10936
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10936
- https://github.com/advisories/GHSA-568q-9fw5-28wf
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E
- https://www.postgresql.org/about/news/1883
- http://www.securityfocus.com/bid/105220
- Weakness (CWE)
CWE-297- Platform
- Java / Kotlin (Maven)
- Package
org.postgresql:pgjdbc-aggregate- Disclosed
- 19.10.2018
- Updated
- 11.10.2026 12:21
Sources and licenses
OSV / GitHub Advisory Database - GHSA-568q-9fw5-28wf - CC BY 4.0
Vulnerability history: org.postgresql:pgjdbc-aggregate
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.