CVE-2023-5868

Name	CVE-2023-5868
Description	A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output in aggregate function calls, enabling remote users to read some portion of system memory.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3651-1, DSA-5553-1, DSA-5554-1
Debian Bugs	1056283

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
postgresql-13 (PTS)	bullseye	13.16-0+deb11u1	fixed
	bullseye (security)	13.18-0+deb11u1	fixed
postgresql-15 (PTS)	bookworm	15.8-0+deb12u1	fixed
	bookworm (security)	15.10-0+deb12u1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
postgresql-11	source	buster	11.22-0+deb10u1	DLA-3651-1
postgresql-11	source	(unstable)	(unfixed)
postgresql-13	source	bullseye	13.13-0+deb11u1	DSA-5554-1
postgresql-13	source	(unstable)	(unfixed)
postgresql-15	source	bookworm	15.5-0+deb12u1	DSA-5553-1
postgresql-15	source	(unstable)	(unfixed)		1056283
postgresql-16	source	(unstable)	16.1-1

Notes

https://www.postgresql.org/support/security/CVE-2023-5868/
https://www.postgresql.org/about/news/postgresql-161-155-1410-1313-1217-and-1122-released-2749/