KLA61933 Multiple vulnerabilities in PostgreSQL

Multiple vulnerabilities were found in PostgreSQL. Malicious users can exploit these vulnerabilities to obtain sensitive information, cause denial of service.

Below is a complete list of vulnerabilities:

1. Memory disclosure vulnerability in aggregate function calls can be exploited to obtain sensitive information.
2. Buffer overrun vulnerability in array modification can be exploited to obtain sensitive information.
3. Denial of service vulnerability can be exploited to cause denial of service.

Original advisories

PostgreSQL: CVE-2023-5868: Memory disclosure in aggregate function calls

PostgreSQL: CVE-2023-5869: Buffer overrun from integer overflow in array modification

PostgreSQL: CVE-2023-5870: Role “pg_cancel_backend” can signal certain superuser processes

Related products

PostgreSQL

CVE list

CVE-2023-5868 unknown

CVE-2023-5869 unknown

CVE-2023-5870 unknown

Solution

Update to the latest version

Download PostgreSQL

Impacts

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

Affected Products

• PostgreSQL 16.x earlier than 16.1PostgreSQL 15.x earlier than 15.5PostgreSQL 14.x earlier than 14.10PostgreSQL 13.x earlier than 13.13PostgreSQL 12.x earlier than 12.17PostgreSQL 11.x earlier than 11.22