CVE-2023-5868 Postgresql: memory disclosure in aggregate function calls
A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output in aggregate function calls, enabling remote users to read some portion of system memory.
Problem types: cwe_id: CWE-686
description: Function Call With Incorrect Argument Type
Affected products: vendor: Red Hat
product: Red Hat Advanced Cluster Security 4.2
cpes: cpe:/a:redhat:advanced_cluster_security:4.2::el8
default_status: affected
vendor: Red Hat
product: Red Hat Advanced Cluster Security 4.2
cpes: cpe:/a:redhat:advanced_cluster_security:4.2::el8
default_status: affected
vendor: Red Hat
product: Red Hat Advanced Cluster Security 4.2
cpes: cpe:/a:redhat:advanced_cluster_security:4.2::el8
default_status: affected
vendor: Red Hat
product: Red Hat Advanced Cluster Security 4.2
cpes: cpe:/a:redhat:advanced_cluster_security:4.2::el8
default_status: affected
vendor: Red Hat
product: Red Hat Advanced Cluster Security 4.2
cpes: cpe:/a:redhat:advanced_cluster_security:4.2::el8
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/a:redhat:enterprise_linux:8::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/a:redhat:enterprise_linux:8::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/a:redhat:enterprise_linux:8::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.2 Advanced Update Support
cpes: cpe:/a:redhat:rhel_tus:8.2::appstream
cpe:/a:redhat:rhel_aus:8.2::appstream
cpe:/a:redhat:rhel_e4s:8.2::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.2 Telecommunications Update Service
cpes: cpe:/a:redhat:rhel_tus:8.2::appstream
cpe:/a:redhat:rhel_aus:8.2::appstream
cpe:/a:redhat:rhel_e4s:8.2::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_tus:8.2::appstream
cpe:/a:redhat:rhel_aus:8.2::appstream
cpe:/a:redhat:rhel_e4s:8.2::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
cpes: cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_e4s:8.4::appstream
cpe:/a:redhat:rhel_tus:8.4::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
cpes: cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_e4s:8.4::appstream
cpe:/a:redhat:rhel_tus:8.4::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.4 Telecommunications Update Service
cpes: cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_e4s:8.4::appstream
cpe:/a:redhat:rhel_tus:8.4::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.4 Telecommunications Update Service
cpes: cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_e4s:8.4::appstream
cpe:/a:redhat:rhel_tus:8.4::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_e4s:8.4::appstream
cpe:/a:redhat:rhel_tus:8.4::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_e4s:8.4::appstream
cpe:/a:redhat:rhel_tus:8.4::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:8.6::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:8.6::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.8 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:8.8::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.8 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:8.8::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.8 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:8.8::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::crb
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.0 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:9.0::appstream
cpe:/a:redhat:rhel_eus:9.0::crb
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.2 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:9.2::crb
cpe:/a:redhat:rhel_eus:9.2::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.2 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:9.2::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Software Collections for Red Hat Enterprise Linux 7
cpes: cpe:/a:redhat:rhel_software_collections:3::el7
default_status: affected
vendor: Red Hat
product: Red Hat Software Collections for Red Hat Enterprise Linux 7
cpes: cpe:/a:redhat:rhel_software_collections:3::el7
default_status: affected
vendor: Red Hat
product: RHACS-3.74-RHEL-8
cpes: cpe:/a:redhat:advanced_cluster_security:3.74::el8
default_status: affected
vendor: Red Hat
product: RHACS-3.74-RHEL-8
cpes: cpe:/a:redhat:advanced_cluster_security:3.74::el8
default_status: affected
vendor: Red Hat
product: RHACS-3.74-RHEL-8
cpes: cpe:/a:redhat:advanced_cluster_security:3.74::el8
default_status: affected
vendor: Red Hat
product: RHACS-3.74-RHEL-8
cpes: cpe:/a:redhat:advanced_cluster_security:3.74::el8
default_status: affected
vendor: Red Hat
product: RHACS-3.74-RHEL-8
cpes: cpe:/a:redhat:advanced_cluster_security:3.74::el8
default_status: affected
vendor: Red Hat
product: RHACS-4.1-RHEL-8
cpes: cpe:/a:redhat:advanced_cluster_security:4.1::el8
default_status: affected
vendor: Red Hat
product: RHACS-4.1-RHEL-8
cpes: cpe:/a:redhat:advanced_cluster_security:4.1::el8
default_status: affected
vendor: Red Hat
product: RHACS-4.1-RHEL-8
cpes: cpe:/a:redhat:advanced_cluster_security:4.1::el8
default_status: affected
vendor: Red Hat
product: RHACS-4.1-RHEL-8
cpes: cpe:/a:redhat:advanced_cluster_security:4.1::el8
default_status: affected
vendor: Red Hat
product: RHACS-4.1-RHEL-8
cpes: cpe:/a:redhat:advanced_cluster_security:4.1::el8
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: unaffected
vendor: Red Hat
product: Red Hat Software Collections
cpes: cpe:/a:redhat:rhel_software_collections:3
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Upstream acknowledges Jingzhou Fu as the original reporter.
Published: 2023-12-10T17:56:57.176Z