CVE-2023-5868: PostgreSQL Information Disclosure Flaw

CVE-2023-5868 Overview

CVE-2023-5868 is a memory disclosure vulnerability in PostgreSQL caused by improper handling of unknown-type arguments in certain aggregate function calls. Authenticated remote database users can supply string literals without an explicit type designation to trigger excessive data output, leaking bytes from server process memory. Disclosed bytes may contain confidential data resident in the backend process, including query fragments and other session state. The flaw is categorized under CWE-686: Function Call With Incorrect Argument Type and affects PostgreSQL releases prior to 16.1, 15.5, 14.10, 13.13, 12.17, and 11.22, along with Red Hat Enterprise Linux and CodeReady Linux Builder distributions that ship the affected packages.

Critical Impact
Authenticated remote users can read portions of PostgreSQL server process memory by crafting aggregate function calls with unknown-type literal arguments, exposing potentially sensitive in-memory data.

Affected Products

PostgreSQL versions prior to 16.1, 15.5, 14.10, 13.13, 12.17, and 11.22
Red Hat Enterprise Linux 8 and 9 (including EUS, AUS, and TUS variants)
Red Hat CodeReady Linux Builder (EUS, ARM64, IBM Z, Power little-endian) and Red Hat Software Collections 1.0

Discovery Timeline

2023-12-10 - CVE-2023-5868 published to the National Vulnerability Database (NVD)
2025-11-04 - Last updated in NVD database

Technical Details for CVE-2023-5868

Vulnerability Analysis

The vulnerability resides in PostgreSQL's handling of aggregate function calls that receive arguments of the pseudo-type unknown. PostgreSQL assigns the unknown type to string literals that lack an explicit type designation, deferring resolution to the surrounding expression context. When such a value flows into specific aggregate functions, PostgreSQL fails to constrain the output length to the logical value, instead emitting trailing bytes from the underlying memory region.

The leaked bytes originate from the backend server process address space. An attacker can repeat queries to harvest fragments of memory across calls, increasing the probability of recovering sensitive content such as other users' query text, cached values, or authentication-related material held transiently in process memory.

Exploitation requires only a low-privileged database role with permission to execute SQL queries. No interaction with the operating system or local access is needed, and the vector is reachable across any network path that exposes the PostgreSQL listener.

Root Cause

The defect is an information exposure caused by passing values of the unknown pseudo-type to aggregate functions that interpret the value as a fixed-width or padded structure. Without a concrete type to bound the byte length, the aggregate emits more bytes than the literal contains, copying adjacent process memory into the result. This maps to CWE-686: Function Call With Incorrect Argument Type.

Attack Vector

An authenticated attacker submits a SQL statement that invokes a vulnerable aggregate function with a bare string literal — a value PostgreSQL labels as unknown because the literal has no explicit cast. The server returns a result that includes bytes beyond the literal's actual content. By varying the query and repeating it, the attacker reads incremental portions of server memory through the normal query response channel.

For exploitation specifics, see the PostgreSQL CVE-2023-5868 advisory and Red Hat Bugzilla report #2247168.

Detection Methods for CVE-2023-5868

Indicators of Compromise

Repeated SQL queries from a single session that invoke aggregate functions with bare string literals lacking explicit type casts.
Unusually large or anomalous result sets returned from aggregate calls over unknown-typed inputs.
Authenticated sessions issuing iterative variations of the same aggregate query against system catalogs or low-value tables.

Detection Strategies

Enable PostgreSQL statement logging with log_statement = 'all' and inspect query text for aggregate calls receiving unquoted or untyped string literals.
Hunt for high-frequency identical or near-identical aggregate queries originating from non-administrative roles.
Correlate database audit logs with network telemetry to identify clients executing large volumes of low-cost aggregate queries against the server.

Monitoring Recommendations

Forward PostgreSQL logs to a centralized analytics platform and alert on aggregate function patterns referencing untyped literals.
Track per-role query rates and flag accounts whose aggregate-query volume deviates from baseline.
Review the installed PostgreSQL minor version on each host against the fixed releases listed in the PostgreSQL 16.1/15.5/14.10/13.13/12.17/11.22 announcement.

How to Mitigate CVE-2023-5868

Immediate Actions Required

Upgrade PostgreSQL to 16.1, 15.5, 14.10, 13.13, 12.17, or 11.22 or later according to your major version.
Apply the relevant Red Hat errata for affected RHEL and CodeReady Linux Builder channels, including RHSA-2023:7545, RHSA-2023:7579, and the associated 2024 advisories such as RHSA-2024:0304.
Restrict database role privileges so that only trusted accounts can execute ad-hoc SQL against production instances.
Review pg_hba.conf and network controls to limit PostgreSQL exposure to required client networks only.

Patch Information

PostgreSQL released fixed builds on November 9, 2023 covering versions 16.1, 15.5, 14.10, 13.13, 12.17, and 11.22 as announced in the PostgreSQL release notes. Red Hat shipped corresponding package updates across the advisories enumerated in the Red Hat CVE-2023-5868 report. Debian users should apply the update described in the Debian LTS announcement of November 2023. NetApp customers should consult NTAP-20240119-0003 for affected products.

Workarounds

Revoke CONNECT or query privileges from untrusted roles until patching completes.
Enforce application-side query patterns that always cast string literals to explicit types, eliminating reliance on the unknown pseudo-type in aggregate arguments.
Place PostgreSQL behind a network segmentation boundary that restricts client reachability to vetted application tiers.

bash

# Verify the running PostgreSQL server version against fixed releases
psql -U postgres -c "SHOW server_version;"

# Example RHEL/CentOS package update path
sudo dnf update postgresql postgresql-server
sudo systemctl restart postgresql

# Example Debian/Ubuntu package update path
sudo apt-get update
sudo apt-get install --only-upgrade postgresql
sudo systemctl restart postgresql