CVE-2023-5868: Postgresql: memory disclosure in aggregate function calls
A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output in aggregate function calls, enabling remote users to read some portion of system memory.
Other sources
Certain aggregate function calls receiving "unknown"-type arguments could disclose bytes of server memory from the end of the "unknown"-type value to the next zero byte. One typically gets an "unknown"-type value via a string literal having no type designation. We have not confirmed or ruled out viability of attacks that arrange for presence of notable, confidential information in disclosed bytes.
— Red Hat
PostgreSQL could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw when perform certain aggregate function calls. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain bytes of server memory from the end of the "unknown"-type value to the next zero byte, and use this information to launch further attacks against the affected system.
— IBM
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-5868?
CVE-2023-5868 is a vulnerability that allows memory disclosure in aggregate function calls.
Which software is affected by CVE-2023-5868?
The software affected by CVE-2023-5868 includes PostgreSQL versions 11.16-0+deb10u1, 13.11-0+deb11u1, 15.3-0+deb12u1, 16.1-1, and Red Hat PostgreSQL versions 16.1, 15.5, 14.10, 13.13, 12.17, and 11.22. It also affects Ubuntu PostgreSQL versions 14.10-0ubuntu0.22.04.1, 14.10, 12.17-0ubuntu0.20.04.1, 12.17, 15.5, 15.5-0ubuntu0.23.04.1, and 15.5-0ubuntu0.23.10.1.
What is the severity of CVE-2023-5868?
CVE-2023-5868 has a severity level of medium.
How can I fix the CVE-2023-5868 vulnerability?
To fix the CVE-2023-5868 vulnerability, you should update your PostgreSQL installation to a version that includes the necessary security patches. Please refer to the official PostgreSQL website and your OS package manager for the latest updates and instructions.
Where can I find more information about CVE-2023-5868?
You can find more information about CVE-2023-5868 on the official PostgreSQL website, the Debian Security Tracker, and the provided references.