CVE-2023-5868 Postgresql: memory disclosure in aggregate function calls
Remote attackers can exploit aggregate function calls with unknown-type arguments to read sensitive system memory in PostgreSQL.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-5868?
CVE-2023-5868 is a medium-severity vulnerability in Postgresql Postgresql, published on 10 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output in aggregate function calls, enabling remote users to read some portion of system memory.
Weakness: CWE-686
Which versions are affected by CVE-2023-5868?
1 open source package ship an affected version, including postgresql. It affects 16 products.
| Package | Affected | Fixed in |
|---|---|---|
postgresql Bitnami | From 11.0.0 | 11.22.0, 12.17.0, 13.13.0, 14.10.0, 15.5.0, 16.0.1 |
Products include Postgresql Postgresql, Redhat Codeready Linux Builder Eus, Redhat Codeready Linux Builder Eus for Power Little Endian Eus, Redhat Codeready Linux Builder for Arm64 Eus, Redhat Codeready Linux Builder for Ibm Z Systems Eus, Redhat Codeready Linux Builder for Power Little Endian Eus and 10 more.
How do I fix CVE-2023-5868?
Upgrade postgresql to a fixed version for your release line: 11.22.0, 12.17.0, 13.13.0 or 14.10.0.
Is CVE-2023-5868 being exploited?
There is no known exploitation of CVE-2023-5868 in the wild and no public exploit code.
Other vulnerabilities in Postgresql Postgresql
Sources
Also known as ALPINE-CVE-2023-5868, AZL-32106, BELL-CVE-2023-5868, BIT-postgresql-2023-5868, CLEANSTART-2026-JD37353, DEBIAN-CVE-2023-5868 and 4 more.