CVE-2023-5869
published 2023-12-10CVE-2023-5869: A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value…
PriorityP264high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
4.32%
90.1th percentile
A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.
Affected
52 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | postgresql-13 | < postgresql-13 13.13-0+deb11u1 (bullseye) | postgresql-13 13.13-0+deb11u1 (bullseye) |
| debian | postgresql-15 | < postgresql-13 13.13-0+deb11u1 (bullseye) | postgresql-13 13.13-0+deb11u1 (bullseye) |
| msrc | cbl2_postgresql_14.10-1_on_cbl_mariner_2.0 | — | — |
| postgresql | postgresql | — | — |
| postgresql | postgresql | >= 11.0 < 11.22 | 11.22 |
| postgresql | postgresql | >= 12.0 < 12.17 | 12.17 |
| postgresql | postgresql | >= 13.0 < 13.13 | 13.13 |
| postgresql | postgresql | >= 14.0 < 14.10 | 14.10 |
| postgresql | postgresql | >= 15.0 < 15.5 | 15.5 |
| redhat | codeready_linux_builder_eus | — | — |
| redhat | codeready_linux_builder_eus_for_power_little_endian_eus | — | — |
| redhat | codeready_linux_builder_eus_for_power_little_endian_eus | — | — |
| redhat | codeready_linux_builder_for_arm64_eus | — | — |
| redhat | codeready_linux_builder_for_arm64_eus | — | — |
| redhat | codeready_linux_builder_for_arm64_eus | — | — |
| redhat | codeready_linux_builder_for_ibm_z_systems_eus | — | — |
| redhat | codeready_linux_builder_for_ibm_z_systems_eus | — | — |
| redhat | codeready_linux_builder_for_power_little_endian_eus | — | — |
| redhat | codeready_linux_builder_for_power_little_endian_eus | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger condition: integer overflow during SQL array value modification — look for authenticated database users submitting specially crafted array modification queries that could cause buffer overrun in PostgreSQL ↗
- →Impact indicators: successful exploitation allows writing arbitrary bytes to memory and extensive server memory reads — monitor PostgreSQL for unexpected crashes, memory corruption errors, or abnormal process behavior following array modification operations ↗
- →Vulnerability class: buffer overrun from integer overflow specifically in array modification code path — audit PostgreSQL logs for anomalous or oversized array value modification statements from authenticated users ↗
- ·Only authenticated database users can trigger this vulnerability — unauthenticated remote exploitation is not possible ↗
- ·Red Hat Enterprise Linux 8 and 9 with postgresql:16 stream are NOT affected; only older PostgreSQL versions on RHEL are impacted ↗
- ·Debian bullseye fix is available in postgresql 13.13-0+deb11u1 — systems running older versions remain vulnerable ↗
- ·No practical mitigation has been identified by Red Hat other than patching — update the affected package as soon as possible ↗
- ·A PostgreSQL service restart is required after patching for changes to take effect ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian8.8HIGH
vendor_msrc8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
postgresql-10 vulnerabilities
osv·2024-01-17·CVSS 4.3
CVE-2023-5868 [MEDIUM] postgresql-10 vulnerabilities
postgresql-10 vulnerabilities
USN-6538-1 fixed several vulnerabilities in PostgreSQL. This update provides
the corresponding updates for Ubuntu 18.04 LTS.
Original advisory details:
Jingzhou Fu discovered that PostgreSQL incorrectly handled certain unknown
arguments in aggregate function calls. A remote attacker could possibly use
this issue to obtain sensitive information. (CVE-2023-5868)
Pedro Gallegos discovered that PostgreSQL incorrectly handled modifying
certain SQL array values. A remote attacker could use this issue to obtain
sensitive information, or possibly execute arbitrary code. (CVE-2023-5869)
Hemanth Sandrana and Mahendrakar Srinivasarao discovered that PostgreSQL
allowed the pg_signal_backend role to signal certain superuser processes,
contrary to expectations. (CVE-20
OSV
postgresql-9.5 vulnerabilities
osv·2024-01-09·CVSS 8.8
CVE-2023-5869 [HIGH] postgresql-9.5 vulnerabilities
postgresql-9.5 vulnerabilities
Pedro Gallegos discovered that PostgreSQL incorrectly handled modifying
certain SQL array values. A remote attacker could use this issue to obtain
sensitive information, or possibly execute arbitrary code. (CVE-2023-5869)
Hemanth Sandrana and Mahendrakar Srinivasarao discovered that PostgreSQL
allowed the pg_signal_backend role to signal certain superuser processes,
contrary to expectations. (CVE-2023-5870)
GHSA
GHSA-9625-p7pg-3cxg: A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array val
ghsa_unreviewed·2023-12-10
CVE-2023-5869 [HIGH] CWE-119 GHSA-9625-p7pg-3cxg: A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array val
A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.
OSV
CVE-2023-5869: A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array val
osv·2023-12-10·CVSS 8.8
CVE-2023-5869 [HIGH] CVE-2023-5869: A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array val
A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.
OSV
postgresql-12, postgresql-14, postgresql-15 vulnerabilities
osv·2023-12-06·CVSS 4.3
CVE-2023-5868 [MEDIUM] postgresql-12, postgresql-14, postgresql-15 vulnerabilities
postgresql-12, postgresql-14, postgresql-15 vulnerabilities
Jingzhou Fu discovered that PostgreSQL incorrectly handled certain unknown
arguments in aggregate function calls. A remote attacker could possibly use
this issue to obtain sensitive information. (CVE-2023-5868)
Pedro Gallegos discovered that PostgreSQL incorrectly handled modifying
certain SQL array values. A remote attacker could use this issue to obtain
sensitive information, or possibly execute arbitrary code. (CVE-2023-5869)
Hemanth Sandrana and Mahendrakar Srinivasarao discovered that PostgreSQL
allowed the pg_signal_backend role to signal certain superuser processes,
contrary to expectations. (CVE-2023-5870)
CISA ICS
Siemens SINEC NMS
cisa_ics·2024-08-15·CVSS 7.0
[HIGH] Siemens SINEC NMS
ICS Advisory
##
Siemens SINEC NMS
Release DateAugust 15, 2024
Alert CodeICSA-24-228-06
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 9.4
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINEC NMS
- Vulnerabilities: Use After Free, Improper Input Validation, Deserialization of Untrusted Data, Improper Restriction of Operations
Ubuntu
PostgreSQL vulnerabilities
vendor_ubuntu·2024-01-17·CVSS 4.3
CVE-2023-5868 [MEDIUM] PostgreSQL vulnerabilities
Title: PostgreSQL vulnerabilities
Summary: Several security issues were fixed in PostgreSQL.
USN-6538-1 fixed several vulnerabilities in PostgreSQL. This update provides
the corresponding updates for Ubuntu 18.04 LTS.
Original advisory details:
Jingzhou Fu discovered that PostgreSQL incorrectly handled certain unknown
arguments in aggregate function calls. A remote attacker could possibly use
this issue to obtain sensitive information. (CVE-2023-5868)
Pedro Gallegos discovered that PostgreSQL incorrectly handled modifying
certain SQL array values. A remote attacker could use this issue to obtain
sensitive information, or possibly execute arbitrary code. (CVE-2023-5869)
Hemanth Sandrana and Mahendrakar Srinivasarao discovered that PostgreSQL
allowed the pg_signal_backend role to signa
Ubuntu
PostgreSQL vulnerabilities
vendor_ubuntu·2024-01-09·CVSS 8.8
CVE-2023-5869 [HIGH] PostgreSQL vulnerabilities
Title: PostgreSQL vulnerabilities
Summary: Several security issues were fixed in PostgreSQL.
Pedro Gallegos discovered that PostgreSQL incorrectly handled modifying
certain SQL array values. A remote attacker could use this issue to obtain
sensitive information, or possibly execute arbitrary code. (CVE-2023-5869)
Hemanth Sandrana and Mahendrakar Srinivasarao discovered that PostgreSQL
allowed the pg_signal_backend role to signal certain superuser processes,
contrary to expectations. (CVE-2023-5870)
Instructions: After a standard system update you need to restart PostgreSQL to make
all the necessary changes.
Microsoft
Postgresql: buffer overrun from integer overflow in array modification
vendor_msrc·2023-12-12·CVSS 8.8
CVE-2023-5869 [HIGH] CWE-190 Postgresql: buffer overrun from integer overflow in array modification
Postgresql: buffer overrun from integer overflow in array modification
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
redhat: redhat
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Referen
Ubuntu
PostgreSQL vulnerabilities
vendor_ubuntu·2023-12-06·CVSS 4.3
CVE-2023-5869 [MEDIUM] PostgreSQL vulnerabilities
Title: PostgreSQL vulnerabilities
Summary: Several security issues were fixed in PostgreSQL.
Jingzhou Fu discovered that PostgreSQL incorrectly handled certain unknown
arguments in aggregate function calls. A remote attacker could possibly use
this issue to obtain sensitive information. (CVE-2023-5868)
Pedro Gallegos discovered that PostgreSQL incorrectly handled modifying
certain SQL array values. A remote attacker could use this issue to obtain
sensitive information, or possibly execute arbitrary code. (CVE-2023-5869)
Hemanth Sandrana and Mahendrakar Srinivasarao discovered that PostgreSQL
allowed the pg_signal_backend role to signal certain superuser processes,
contrary to expectations. (CVE-2023-5870)
Instructions: This update uses a new upstream release, which includes additional
Red Hat
postgresql: Buffer overrun from integer overflow in array modification
vendor_redhat·2023-11-09·CVSS 8.8
CVE-2023-5869 [HIGH] CWE-190 postgresql: Buffer overrun from integer overflow in array modification
postgresql: Buffer overrun from integer overflow in array modification
A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.
A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a re
Debian
CVE-2023-5869: postgresql-13 - A flaw was found in PostgreSQL that allows authenticated database users to execu...
vendor_debian·2023·CVSS 8.8
CVE-2023-5869 [HIGH] CVE-2023-5869: postgresql-13 - A flaw was found in PostgreSQL that allows authenticated database users to execu...
A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.
Scope: local
bullseye: resolved (fixed in 13.13-0+deb11u1)
No detection rules found.
No public exploits indexed.
https://access.redhat.com/errata/RHSA-2023:7545https://access.redhat.com/errata/RHSA-2023:7579https://access.redhat.com/errata/RHSA-2023:7580https://access.redhat.com/errata/RHSA-2023:7581https://access.redhat.com/errata/RHSA-2023:7616https://access.redhat.com/errata/RHSA-2023:7656https://access.redhat.com/errata/RHSA-2023:7666https://access.redhat.com/errata/RHSA-2023:7667https://access.redhat.com/errata/RHSA-2023:7694https://access.redhat.com/errata/RHSA-2023:7695https://access.redhat.com/errata/RHSA-2023:7714https://access.redhat.com/errata/RHSA-2023:7770https://access.redhat.com/errata/RHSA-2023:7771https://access.redhat.com/errata/RHSA-2023:7772https://access.redhat.com/errata/RHSA-2023:7778https://access.redhat.com/errata/RHSA-2023:7783https://access.redhat.com/errata/RHSA-2023:7784https://access.redhat.com/errata/RHSA-2023:7785https://access.redhat.com/errata/RHSA-2023:7786https://access.redhat.com/errata/RHSA-2023:7788https://access.redhat.com/errata/RHSA-2023:7789https://access.redhat.com/errata/RHSA-2023:7790https://access.redhat.com/errata/RHSA-2023:7878https://access.redhat.com/errata/RHSA-2023:7883https://access.redhat.com/errata/RHSA-2023:7884https://access.redhat.com/errata/RHSA-2023:7885https://access.redhat.com/errata/RHSA-2024:0304https://access.redhat.com/errata/RHSA-2024:0332https://access.redhat.com/errata/RHSA-2024:0337https://access.redhat.com/security/cve/CVE-2023-5869https://bugzilla.redhat.com/show_bug.cgi?id=2247169https://www.postgresql.org/about/news/postgresql-161-155-1410-1313-1217-and-1122-released-2749/https://www.postgresql.org/support/security/CVE-2023-5869/https://access.redhat.com/errata/RHSA-2023:7545https://access.redhat.com/errata/RHSA-2023:7579https://access.redhat.com/errata/RHSA-2023:7580https://access.redhat.com/errata/RHSA-2023:7581https://access.redhat.com/errata/RHSA-2023:7616https://access.redhat.com/errata/RHSA-2023:7656https://access.redhat.com/errata/RHSA-2023:7666https://access.redhat.com/errata/RHSA-2023:7667https://access.redhat.com/errata/RHSA-2023:7694https://access.redhat.com/errata/RHSA-2023:7695https://access.redhat.com/errata/RHSA-2023:7714https://access.redhat.com/errata/RHSA-2023:7770https://access.redhat.com/errata/RHSA-2023:7771https://access.redhat.com/errata/RHSA-2023:7772https://access.redhat.com/errata/RHSA-2023:7778https://access.redhat.com/errata/RHSA-2023:7783https://access.redhat.com/errata/RHSA-2023:7784https://access.redhat.com/errata/RHSA-2023:7785https://access.redhat.com/errata/RHSA-2023:7786https://access.redhat.com/errata/RHSA-2023:7788https://access.redhat.com/errata/RHSA-2023:7789https://access.redhat.com/errata/RHSA-2023:7790https://access.redhat.com/errata/RHSA-2023:7878https://access.redhat.com/errata/RHSA-2023:7883https://access.redhat.com/errata/RHSA-2023:7884https://access.redhat.com/errata/RHSA-2023:7885https://access.redhat.com/errata/RHSA-2024:0304https://access.redhat.com/errata/RHSA-2024:0332https://access.redhat.com/errata/RHSA-2024:0337https://access.redhat.com/security/cve/CVE-2023-5869https://bugzilla.redhat.com/show_bug.cgi?id=2247169https://lists.debian.org/debian-lts-announce/2023/11/msg00007.htmlhttps://security.netapp.com/advisory/ntap-20240119-0003/https://www.postgresql.org/about/news/postgresql-161-155-1410-1313-1217-and-1122-released-2749/https://www.postgresql.org/support/security/CVE-2023-5869/
2023-12-10
Published