Medium severity · published Dec 10, 2023
CVE-2023-5868
A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with…
4.3
CVSS
2.8%
EPSS
No
On KEV
Description
A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output in aggregate function calls, enabling remote users to read some portion of system memory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
PostgreSQL · PostgreSQL
11.0 before 11.22; 12.0 before 12.17; 13.0 before 13.13; 14.0 before 14.10; 15.0 before 15.5; 16.0 · source: NVD
CL
Codeready Linux Builder Eus · Redhat
9.2 · source: NVD
CL
Codeready Linux Builder Eus For Power Little Endian Eus · Redhat
9.0_ppc64le; 9.2_ppc64le · source: NVD
CL
Codeready Linux Builder For Arm64 Eus · Redhat
8.6_aarch64; 9.0_aarch64; 9.2_aarch64 · source: NVD
CL
Codeready Linux Builder For Ibm Z Systems Eus · Redhat
9.0_s390x; 9.2_s390x · source: NVD
CL
Codeready Linux Builder For Power Little Endian Eus · Redhat
9.0_ppc64le; 9.2_ppc64le · source: NVD
EL
Enterprise Linux · Redhat
8.0; 9.0 · source: NVD
EL
Enterprise Linux Eus · Redhat
8.6; 8.8; 9.0; 9.2 · source: NVD
EL
Enterprise Linux For Arm 64 · Redhat
8.0; 8.8_aarch64 · source: NVD
EL
Enterprise Linux For Ibm Z Systems · Redhat
8.0_s390x · source: NVD
EL
Enterprise Linux For Ibm Z Systems Eus · Redhat
8.6_s390x; 8.8_s390x; 9.0_s390x; 9.2_s390x · source: NVD
EL
Enterprise Linux For Power Little Endian · Redhat
8.0_ppc64le · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-5868
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-5868
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7545
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7579
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7580
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7581
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7616
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7656
More from PostgreSQL
9.8
CVE-2015-0244
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message,…
9.8
CVE-2015-3166
The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call…
9.8
CVE-2019-10211
Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via bundled OpenSSL executing code from unprotected directory
9.8
CVE-2018-16850
postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER
9.8
CVE-2017-7546
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts…
