CVE-2023-5869

Severity
8.8HIGH
EPSS
1.6%
top 18.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedDec 10
Latest updateJan 17

Description

A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages12 packages

NVDredhat/codeready_linux_builder9.2, 8.6, 9.0+2
NVDpostgresql/postgresql11.011.22+5
Debianpostgresql-13< 13.13-0+deb11u1
Debianpostgresql-15< 15.5-0+deb12u1

Also affects: Enterprise Linux 8.0, 9.0, 8.6, 8.8, 9.2, 7.0, 7.0_ppc64, 8.2, 8.4

🔴Vulnerability Details

6
OSV
postgresql-10 vulnerabilities2024-01-17
OSV
postgresql-9.5 vulnerabilities2024-01-09
GHSA
GHSA-9625-p7pg-3cxg: A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array val2023-12-10
CVEList
Postgresql: buffer overrun from integer overflow in array modification2023-12-10
OSV
CVE-2023-5869: A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array val2023-12-10

📋Vendor Advisories

6
Ubuntu
PostgreSQL vulnerabilities2024-01-17
Ubuntu
PostgreSQL vulnerabilities2024-01-09
Microsoft
Postgresql: buffer overrun from integer overflow in array modification2023-12-12
Ubuntu
PostgreSQL vulnerabilities2023-12-06
Red Hat
postgresql: Buffer overrun from integer overflow in array modification2023-11-09