CVE-2023-5868

Description

A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output in aggregate function calls, enabling remote users to read some portion of system memory.

How to fix CVE-2023-5868

To remediate CVE-2023-5868, upgrade the affected package to a fixed version below.

—upgrade to 14.10-r0 or later
—upgrade to 15.5-r0 or later
—upgrade to 16.1-r0 or later
—upgrade to 11.22.0 or later
—upgrade to 11.22-0+deb10u1 or later
—upgrade to 13.13-0+deb11u1 or later
—upgrade to 15.5-0+deb12u1 or later

Is CVE-2023-5868 being exploited?

Low — EPSS is 2.7%, meaning exploitation activity has not been observed at scale.

Affected packages (7)

from 0, < 14.10-r0
from 0, < 15.5-r0
from 0, < 16.1-r0
>= 11.0.0, < 11.22.0, >= 12.0.0, < 12.17.0, >= 13.0.0, < 13.13.0, >= 14.0.0, < 14.10.0, >= 15.0.0, < 15.5.0, >= 16.0.0, < 16.0.1
from 0, < 11.22-0+deb10u1
from 0, < 13.13-0+deb11u1
from 0, < 15.5-0+deb12u1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N