CVE-2023-5868
MediumCVSS 4.3Exploitation Probability (EPSS)
High risk84th percentile - higher than 84% of all known CVEs
Summary
A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information.
Risk Assessment
This vulnerability poses a risk of disclosing confidential data, which may lead to breaches of privacy and security for the organization. Remote users could access portions of system memory, increasing the risk of information leakage.
Recommendation
It is recommended to update PostgreSQL to the latest version to patch this vulnerability. Additionally, it is advisable to restrict access to aggregate functions for remote users and monitor logs for potential attempts to exploit this flaw.
Original NVD description (English source)
A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output in aggregate function calls, enabling remote users to read some portion of system memory.