Django REST framework

Lookup for vulnerable packages by Package URL.

Purl pkg:maven/org.postgresql/pgjdbc-aggregate@42.2.5

Type maven

Namespace org.postgresql

Name pgjdbc-aggregate

Version 42.2.5

Qualifiers

Subpath

Is_vulnerable false

Next_non_vulnerable_version 42.2.5

Latest_non_vulnerable_version 42.2.5

Affected_by_vulnerabilities

Fixing_vulnerabilities

url VCID-1vpc-un4w-kyg9

vulnerability_id VCID-1vpc-un4w-kyg9

summary

Improper Validation of Certificate with Host Mismatch
A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.

references

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2018-10936
reference_id	CVE-2018-10936
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2018-10936

reference_url	https://github.com/advisories/GHSA-568q-9fw5-28wf
reference_id	GHSA-568q-9fw5-28wf
reference_type
scores
url	https://github.com/advisories/GHSA-568q-9fw5-28wf

fixed_packages

url	pkg:maven/org.postgresql/pgjdbc-aggregate@42.2.5
purl	pkg:maven/org.postgresql/pgjdbc-aggregate@42.2.5
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.postgresql/pgjdbc-aggregate@42.2.5

aliases CVE-2018-10936, GHSA-568q-9fw5-28wf

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-1vpc-un4w-kyg9

Risk_score null

Resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.postgresql/pgjdbc-aggregate@42.2.5

Package Instance