CVE-2023-5868

MediumCVSS 4.3/10Last modified Nov 5, 2026

Description

A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output in aggregate function calls, enabling remote users to read some portion of system memory.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-686

Affected software

VendorProductVersions
Red HatRed Hat Advanced Cluster Security 4.2—
Red HatRed Hat Advanced Cluster Security 4.2—
Red HatRed Hat Advanced Cluster Security 4.2—
Red HatRed Hat Advanced Cluster Security 4.2—
Red HatRed Hat Advanced Cluster Security 4.2—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support—
Red HatRed Hat Enterprise Linux 8.2 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.4 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.4 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.4 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.4 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support—
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support—
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support—
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support—
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support—
Red HatRed Hat Software Collections for Red Hat Enterprise Linux 7—
Red HatRed Hat Software Collections for Red Hat Enterprise Linux 7—
Red HatRHACS-3.74-RHEL-8—
Red HatRHACS-3.74-RHEL-8—
Red HatRHACS-3.74-RHEL-8—
Red HatRHACS-3.74-RHEL-8—
Red HatRHACS-3.74-RHEL-8—
Red HatRHACS-4.1-RHEL-8—
Red HatRHACS-4.1-RHEL-8—
Red HatRHACS-4.1-RHEL-8—
Red HatRHACS-4.1-RHEL-8—
Red HatRHACS-4.1-RHEL-8—
Red HatRed Hat Enterprise Linux 6—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Software Collections—

References

Timeline

Published
Dec 10, 2023
Last modified
Nov 5, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-58698.8A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQLCVE-2023-58704.4A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcCVE-2023-58715.3A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a CVE-2023-58724.3In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames through iterative requCVE-2023-58735.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 11.1.0.CVE-2023-58744.8The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such aCVE-2023-58755.3Mattermost Desktop fails to correctly handle permissions or prompt the user for consent on certain sensitive ones allowing media exploitatioCVE-2023-58765.3Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mountCVE-2023-58779.8The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/toCVE-2023-58789.4Honeywell OneWireless Wireless Device Manager (WDM) for the following versions R310.x, R320.x, R321.x, R322.1, R322.2, R323.x, R330.1 contCVE-2023-58796.8Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 BuiCVE-2023-58808.8When the Genie Company Aladdin Connect garage door opener (Retrofit-Kit Model ALDCM) is placed into configuration mode the web servers “Gara