Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2023-5868— Postgresql: memory disclosure in aggregate function calls

Quick assessment

Affected

Red Hat Red Hat Advanced Cluster Security 4.2

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PostgreSQL是PostgreSQL组织的一套自由的对象关系型数据库管理系统。该系统支持大部分SQL标准并且提供了许多其他特性，例如外键、触发器、视图等。 PostgreSQL存在安全漏洞，该漏洞源于aggregate函数存在内存泄漏漏洞。受影响的产品和版本：PostgreSQL 16.1之前的16版本，15.5之前的15版本，14.10之前的14版本，13.13之前的13版本，12.17之前的12版本，11.22之前的11版本。

CVSS 4.3 · Medium EPSS 2.77% · P86 Updated Jun 27, 2026

Possible ATT&CK Techniques 1 AI

T1005 · Data from Local System

Affected Version Matrix 45

Vendor	Product	Version Range	Status
Red Hat	Red Hat Advanced Cluster Security 4.2	`4.2.4-6< *`	unaffected
		`4.2.4-6< *`	unaffected
		`4.2.4-7< *`	unaffected
		`4.2.4-6< *`	unaffected
		`4.2.4-7< *`	unaffected
Red Hat	Red Hat Enterprise Linux 6	`any`	unknown
Red Hat	Red Hat Enterprise Linux 7	`any`	affected
Red Hat	Red Hat Enterprise Linux 8	`8090020231114113712.a75119d5< *`	unaffected
		`8090020231128173330.a75119d5< *`	unaffected
		`8090020231114113548.a75119d5< *`	unaffected
		`any`	affected
		`any`	unaffected
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	`8020020231128165246.4cda2c84< *`	unaffected
Red Hat	Red Hat Enterprise Linux 8.2 Telecommunications Update Service	`8020020231128165246.4cda2c84< *`	unaffected
Red Hat	Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions	`8020020231128165246.4cda2c84< *`	unaffected
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	`8040020231127153301.522a0ee4< *`	unaffected
		`8040020231127154806.522a0ee4< *`	unaffected
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	`8040020231127153301.522a0ee4< *`	unaffected
		`8040020231127154806.522a0ee4< *`	unaffected
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	`8040020231127153301.522a0ee4< *`	unaffected
		`8040020231127154806.522a0ee4< *`	unaffected
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	`8060020231114115246.ad008a3a< *`	unaffected
		`8060020231128165328.ad008a3a< *`	unaffected
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	`8080020231114105206.63b34585< *`	unaffected
		`8080020231128165335.63b34585< *`	unaffected
		`8080020231113134015.63b34585< *`	unaffected
Red Hat	Red Hat Enterprise Linux 9	`0:13.13-1.el9_3< *`	unaffected
		`9030020231120082734.rhel9< *`	unaffected
		`any`	unaffected
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	`0:13.13-1.el9_0< *`	unaffected
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	`0:13.13-1.el9_2< *`	unaffected
		`9020020231115020618.rhel9< *`	unaffected
Red Hat	Red Hat Software Collections	`any`	affected
Red Hat	Red Hat Software Collections for Red Hat Enterprise Linux 7	`0:12.17-1.el7< *`	unaffected
		`0:13.13-1.el7< *`	unaffected
Red Hat	RHACS-3.74-RHEL-8	`3.74.8-9< *`	unaffected
		`3.74.8-9< *`	unaffected
		`3.74.8-7< *`	unaffected
		`3.74.8-9< *`	unaffected
		`3.74.8-9< *`	unaffected
Red Hat	RHACS-4.1-RHEL-8	`4.1.6-6< *`	unaffected
		`4.1.6-6< *`	unaffected
		`4.1.6-6< *`	unaffected
		`4.1.6-6< *`	unaffected
		`4.1.6-6< *`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-5868

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Postgresql: memory disclosure in aggregate function calls

Source: CVE Program / CVE List V5

Vulnerability Description

A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output in aggregate function calls, enabling remote users to read some portion of system memory.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

使用不正确参数类型的函数调用

Source: CVE Program / CVE List V5

Vulnerability Title

PostgreSQL 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE
Red Hat	Red Hat Advanced Cluster Security 4.2	4.2.4-6 ~ *	`cpe:/a:redhat:advanced_cluster_security:4.2::el8`
Red Hat	Red Hat Advanced Cluster Security 4.2	4.2.4-6 ~ *	`cpe:/a:redhat:advanced_cluster_security:4.2::el8`
Red Hat	Red Hat Advanced Cluster Security 4.2	4.2.4-7 ~ *	`cpe:/a:redhat:advanced_cluster_security:4.2::el8`
Red Hat	Red Hat Advanced Cluster Security 4.2	4.2.4-6 ~ *	`cpe:/a:redhat:advanced_cluster_security:4.2::el8`
Red Hat	Red Hat Advanced Cluster Security 4.2	4.2.4-7 ~ *	`cpe:/a:redhat:advanced_cluster_security:4.2::el8`
Red Hat	Red Hat Enterprise Linux 8	8090020231114113712.a75119d5 ~ *	`cpe:/a:redhat:enterprise_linux:8::appstream`
Red Hat	Red Hat Enterprise Linux 8	8090020231128173330.a75119d5 ~ *	`cpe:/a:redhat:enterprise_linux:8::appstream`
Red Hat	Red Hat Enterprise Linux 8	8090020231114113548.a75119d5 ~ *	`cpe:/a:redhat:enterprise_linux:8::appstream`
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	8020020231128165246.4cda2c84 ~ *	`cpe:/a:redhat:rhel_tus:8.2::appstream`
Red Hat	Red Hat Enterprise Linux 8.2 Telecommunications Update Service	8020020231128165246.4cda2c84 ~ *	`cpe:/a:redhat:rhel_tus:8.2::appstream`
Red Hat	Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions	8020020231128165246.4cda2c84 ~ *	`cpe:/a:redhat:rhel_tus:8.2::appstream`
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	8040020231127153301.522a0ee4 ~ *	`cpe:/a:redhat:rhel_aus:8.4::appstream`
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	8040020231127154806.522a0ee4 ~ *	`cpe:/a:redhat:rhel_aus:8.4::appstream`
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	8040020231127153301.522a0ee4 ~ *	`cpe:/a:redhat:rhel_aus:8.4::appstream`
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	8040020231127154806.522a0ee4 ~ *	`cpe:/a:redhat:rhel_aus:8.4::appstream`
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	8040020231127153301.522a0ee4 ~ *	`cpe:/a:redhat:rhel_aus:8.4::appstream`
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	8040020231127154806.522a0ee4 ~ *	`cpe:/a:redhat:rhel_aus:8.4::appstream`
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	8060020231114115246.ad008a3a ~ *	`cpe:/a:redhat:rhel_eus:8.6::appstream`
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	8060020231128165328.ad008a3a ~ *	`cpe:/a:redhat:rhel_eus:8.6::appstream`
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	8080020231114105206.63b34585 ~ *	`cpe:/a:redhat:rhel_eus:8.8::appstream`
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	8080020231128165335.63b34585 ~ *	`cpe:/a:redhat:rhel_eus:8.8::appstream`
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	8080020231113134015.63b34585 ~ *	`cpe:/a:redhat:rhel_eus:8.8::appstream`
Red Hat	Red Hat Enterprise Linux 9	0:13.13-1.el9_3 ~ *	`cpe:/a:redhat:enterprise_linux:9::appstream`
Red Hat	Red Hat Enterprise Linux 9	9030020231120082734.rhel9 ~ *	`cpe:/a:redhat:enterprise_linux:9::appstream`
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	0:13.13-1.el9_0 ~ *	`cpe:/a:redhat:rhel_eus:9.0::appstream`
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	0:13.13-1.el9_2 ~ *	`cpe:/a:redhat:rhel_eus:9.2::crb`
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	9020020231115020618.rhel9 ~ *	`cpe:/a:redhat:rhel_eus:9.2::appstream`
Red Hat	Red Hat Software Collections for Red Hat Enterprise Linux 7	0:12.17-1.el7 ~ *	`cpe:/a:redhat:rhel_software_collections:3::el7`
Red Hat	Red Hat Software Collections for Red Hat Enterprise Linux 7	0:13.13-1.el7 ~ *	`cpe:/a:redhat:rhel_software_collections:3::el7`
Red Hat	RHACS-3.74-RHEL-8	3.74.8-9 ~ *	`cpe:/a:redhat:advanced_cluster_security:3.74::el8`

II. Public POCs for CVE-2023-5868

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2023-5868

请登录查看更多情报信息。

Vendor Advisories for CVE-2023-5868 (24)

https://security.netapp.com/advisory/ntap-20240119-0003/
https://access.redhat.com/security/cve/CVE-2023-5868 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2247168 issue-tracking x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7785 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7545 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7885 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7581 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7784 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7772 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7616 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7714 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7695 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:0304 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7667 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7579 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7770 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:0337 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7666 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:0332 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7694 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7656 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7580 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7883 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7884 vendor-advisory x_refsource_REDHAT

Other References for CVE-2023-5868 (2)

https://www.cve.org/CVERecord?id=CVE-2023-5868

Same Patch Batch · Red Hat · 2023-12-10 · 3 CVEs total

CVE-2023-5869	8.8 HIGH	Postgresql: buffer overrun from integer overflow in array modification
CVE-2023-5870	2.2 LOW	Postgresql: role pg_signal_backend can signal certain superuser processes.

IV. Related Vulnerabilities

Same product: Red Hat Advanced Cluster Security 4.2

Same vendor: Red Hat

Same weakness: CWE-686

V. Comments for CVE-2023-5868

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2023-5868— Postgresql: memory disclosure in aggregate function calls

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 45

I. Basic Information for CVE-2023-5868

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2023-5868

III. Intelligence Information for CVE-2023-5868

Vendor Advisories for CVE-2023-5868 (24)

Other References for CVE-2023-5868 (2)

Same Patch Batch · Red Hat · 2023-12-10 · 3 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2023-5868

Leave a comment