{"id":"CVE-2023-5868","title":"A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments","summary":"A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string l…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-686"],"vendor":"postgresql","product":"postgresql","affected":["postgresql >= 11.0, < 11.22","postgresql >= 12.0, < 12.17","postgresql >= 13.0, < 13.13","postgresql >= 14.0, < 14.10","postgresql >= 15.0, < 15.5","postgresql = 16.0","codeready_linux_builder_eus = 9.2","codeready_linux_builder_eus_for_power_little_endian_eus = 9.0_ppc64le","codeready_linux_builder_eus_for_power_little_endian_eus = 9.2_ppc64le","codeready_linux_builder_for_arm64_eus = 8.6_aarch64","codeready_linux_builder_for_arm64_eus = 9.0_aarch64","codeready_linux_builder_for_arm64_eus = 9.2_aarch64","codeready_linux_builder_for_ibm_z_systems_eus = 9.0_s390x","codeready_linux_builder_for_ibm_z_systems_eus = 9.2_s390x","codeready_linux_builder_for_power_little_endian_eus = 9.0_ppc64le","codeready_linux_builder_for_power_little_endian_eus = 9.2_ppc64le","software_collections = 1.0","enterprise_linux = 8.0","enterprise_linux = 9.0","enterprise_linux_eus = 8.6","enterprise_linux_eus = 8.8","enterprise_linux_eus = 9.0","enterprise_linux_eus = 9.2","enterprise_linux_for_arm_64 = 8.0","enterprise_linux_for_arm_64 = 8.8_aarch64","enterprise_linux_for_ibm_z_systems = 8.0_s390x","enterprise_linux_for_ibm_z_systems_eus = 8.6_s390x","enterprise_linux_for_ibm_z_systems_eus = 8.8_s390x","enterprise_linux_for_ibm_z_systems_eus = 9.0_s390x","enterprise_linux_for_ibm_z_systems_eus = 9.2_s390x","enterprise_linux_for_power_little_endian = 8.0_ppc64le","enterprise_linux_for_power_little_endian_eus = 8.6_ppc64le","enterprise_linux_for_power_little_endian_eus = 8.8_ppc64le","enterprise_linux_for_power_little_endian_eus = 9.0_ppc64le","enterprise_linux_for_power_little_endian_eus = 9.2_ppc64le","enterprise_linux_server_aus = 8.2","enterprise_linux_server_aus = 8.4","enterprise_linux_server_aus = 8.6","enterprise_linux_server_aus = 9.2","enterprise_linux_server_tus = 8.2","enterprise_linux_server_tus = 8.4","enterprise_linux_server_tus = 8.6"],"patched":["postgresql 15.5"],"published":"2023-12-10","updated":"2026-06-23","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-5868","references":[{"url":"https://access.redhat.com/errata/RHSA-2023:7545","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:7579","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:7580","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:7581","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:7616","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:7656","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:7666","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:7667","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:7694","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:7695","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:7714","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:7770","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:7772","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:7784","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:7785","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:7883","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:7884","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:7885","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:0304","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:0332","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:0337","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2023-5868","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2247168","label":"secalert@redhat.com"},{"url":"https://www.postgresql.org/about/news/postgresql-161-155-1410-1313-1217-and-1122-released-2749/","label":"secalert@redhat.com"},{"url":"https://www.postgresql.org/support/security/CVE-2023-5868/","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:7545","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:7579","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:7580","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:7581","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:7616","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:7656","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:7666","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:7667","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:7694","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:7695","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:7714","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:7770","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:7772","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:7784","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:7785","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:7883","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:7884","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:7885","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2024:0304","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2024:0332","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2024:0337","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/security/cve/CVE-2023-5868","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2247168","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2023/11/msg00007.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20240119-0003/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.postgresql.org/about/news/postgresql-161-155-1410-1313-1217-and-1122-released-2749/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.postgresql.org/support/security/CVE-2023-5868/","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.02775,"epssPercentile":0.85647,"ingestedAt":"2026-06-29T13:24:33.946Z","slug":"CVE-2023-5868","body":"## Overview\n\nA memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output in aggregate function calls, enabling remote users to read some portion of system memory.\n\n## Affected\n\n- `postgresql >= 11.0, < 11.22`\n- `postgresql >= 12.0, < 12.17`\n- `postgresql >= 13.0, < 13.13`\n- `postgresql >= 14.0, < 14.10`\n- `postgresql >= 15.0, < 15.5`\n- `postgresql = 16.0`\n- `codeready_linux_builder_eus = 9.2`\n- `codeready_linux_builder_eus_for_power_little_endian_eus = 9.0_ppc64le`\n- `codeready_linux_builder_eus_for_power_little_endian_eus = 9.2_ppc64le`\n- `codeready_linux_builder_for_arm64_eus = 8.6_aarch64`\n- `codeready_linux_builder_for_arm64_eus = 9.0_aarch64`\n- `codeready_linux_builder_for_arm64_eus = 9.2_aarch64`\n- `codeready_linux_builder_for_ibm_z_systems_eus = 9.0_s390x`\n- `codeready_linux_builder_for_ibm_z_systems_eus = 9.2_s390x`\n- `codeready_linux_builder_for_power_little_endian_eus = 9.0_ppc64le`\n- `codeready_linux_builder_for_power_little_endian_eus = 9.2_ppc64le`\n- `software_collections = 1.0`\n- `enterprise_linux = 8.0`\n- `enterprise_linux = 9.0`\n- `enterprise_linux_eus = 8.6`\n- `enterprise_linux_eus = 8.8`\n- `enterprise_linux_eus = 9.0`\n- `enterprise_linux_eus = 9.2`\n- `enterprise_linux_for_arm_64 = 8.0`\n- `enterprise_linux_for_arm_64 = 8.8_aarch64`\n- `enterprise_linux_for_ibm_z_systems = 8.0_s390x`\n- `enterprise_linux_for_ibm_z_systems_eus = 8.6_s390x`\n- `enterprise_linux_for_ibm_z_systems_eus = 8.8_s390x`\n- `enterprise_linux_for_ibm_z_systems_eus = 9.0_s390x`\n- `enterprise_linux_for_ibm_z_systems_eus = 9.2_s390x`\n- `enterprise_linux_for_power_little_endian = 8.0_ppc64le`\n- `enterprise_linux_for_power_little_endian_eus = 8.6_ppc64le`\n- `enterprise_linux_for_power_little_endian_eus = 8.8_ppc64le`\n- `enterprise_linux_for_power_little_endian_eus = 9.0_ppc64le`\n- `enterprise_linux_for_power_little_endian_eus = 9.2_ppc64le`\n- `enterprise_linux_server_aus = 8.2`\n- `enterprise_linux_server_aus = 8.4`\n- `enterprise_linux_server_aus = 8.6`\n- `enterprise_linux_server_aus = 9.2`\n- `enterprise_linux_server_tus = 8.2`\n- `enterprise_linux_server_tus = 8.4`\n- `enterprise_linux_server_tus = 8.6`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `postgresql 15.5`","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.6,"exploitation":0,"ransomware":0},"changes":[]}