What is CVE-2023-5869?

CVE-2023-5869 is a high-severity vulnerability in PostgreSQL, an open-source relational database management system. This flaw allows authenticated database users to execute arbitrary code due to missing overflow checks during SQL array value modification. Systems running vulnerable versions of PostgreSQL, including specific configurations of Red Hat Enterprise Linux, are affected. This vulnerability can lead to unauthorized access and potential data breaches.

Who is impacted by this?

CVE-2023-5869 affects authenticated database users of PostgreSQL versions 11.0 to 11.22, 12.0 to 12.17, 13.0 to 13.13, 14.0 to 14.10, 15.0 to 15.5, and 16.0. Users of Red Hat Enterprise Linux with PostgreSQL installed, including specific configurations of Extended Update Support and Update Services for SAP Solutions, are also impacted. This flaw can lead to unauthorized access and potential data breaches.

What to do if CVE-2023-5869 affected you

If you're affected by the CVE-2023-5869 vulnerability, it's crucial to take action to protect your systems. Follow these simple steps:

1. Update your PostgreSQL installation to the latest version provided by the security advisories, such as RHSA-2023:7545 or RHSA-2023:7579.

2. Monitor the Red Hat security advisories for any further updates or patches related to this vulnerability.

3. Ensure your PostgreSQL service is automatically restarted after installing updates.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-5869 vulnerability in PostgreSQL is not listed in CISA's Known Exploited Vulnerabilities Catalog. This high-severity flaw allows authenticated database users to execute arbitrary code due to missing overflow checks during SQL array value modification. To protect your systems, it's crucial to update your PostgreSQL installation to the latest version and monitor security advisories for further updates or patches.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-190, which involves integer overflow or wraparound issues in PostgreSQL.

Learn More

For a comprehensive understanding of its description, severity, technical details, and affected software configurations, refer to the National Vulnerability Database page and the resources listed below.

• RHSA-2023:7545 - Security Advisory

• RHSA-2023:7579 - Security Advisory

• RHSA-2023:7580 - Security Advisory

• RHSA-2023:7581 - Security Advisory