PostgreSQL up to 16.0 Function Call aggregate information disclosure

Summaryinfo

A vulnerability has been found in PostgreSQL up to 16.0 and classified as problematic. Affected is the function aggregate of the component Function Call Handler. Performing a manipulation results in information disclosure. This vulnerability is reported as CVE-2023-5868. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, was found in PostgreSQL up to 16.0 (Database Software). This affects the function aggregate of the component Function Call Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:

A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output in aggregate function calls, enabling remote users to read some portion of system memory.

The weakness was disclosed 11/10/2023. It is possible to read the advisory at bugzilla.redhat.com. This vulnerability is uniquely identified as CVE-2023-5868 since 10/31/2023. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 216614 (Oracle Linux 9 : postgresql:15 (ELSA-2025-1741)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 11.22, 12.17, 13.13, 14.10, 15.5 or 16.1 eliminates this vulnerability. The upgrade is hosted for download at postgresql.org.

The vulnerability is also documented in the databases at Tenable (216614) and EUVD (EUVD-2023-58142). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Database Software

Name

• PostgreSQL

Version

• 11.0
• 11.1
• 11.2
• 11.3
• 11.4
• 11.5
• 11.6
• 11.7
• 11.8
• 11.9
• 11.10
• 11.11
• 11.12
• 11.13
• 11.14
• 11.15
• 11.16
• 11.17
• 11.18
• 11.19
• 11.20
• 11.21
• 12.0
• 12.1
• 12.2
• 12.3
• 12.4
• 12.5
• 12.6
• 12.7
• 12.8
• 12.9
• 12.10
• 12.11
• 12.12
• 12.13
• 12.14
• 12.15
• 12.16
• 13.0
• 13.1
• 13.2
• 13.3
• 13.4
• 13.5
• 13.6
• 13.7
• 13.8
• 13.9
• 13.10
• 13.11
• 13.12
• 14.0
• 14.1
• 14.2
• 14.3
• 14.4
• 14.5
• 14.6
• 14.7
• 14.8
• 14.9
• 15.0
• 15.1
• 15.2
• 15.3
• 15.4
• 16.0

License

• open-source

Website

• Product: https://www.postgresql.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion