dbcve.org
PostgreSQLDatabase / datastore

CVE-2023-5869

HIGH · 8.8 CVSS v3.1 Published 2023-12-10
Fix available
A fix is available. Upgrade to 11.22 / 12.17 or later.
See remediation →
94/100
Remediation priority · Urgent
Remotely reachable Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

PostgreSQL contains an integer overflow vulnerability in its SQL array value modification functionality. Authenticated database users can trigger the overflow by providing specially crafted data to array operations, potentially achieving arbitrary code execution with the privileges of the database server process, as well as reading and writing arbitrary memory locations.

MitigationApply the PostgreSQL security update corresponding to this vulnerability. Since this requires authentication, ensure database credentials are properly secured and consider network-level restrictions on database access.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
PostgreSQLDatabase / datastore
Affected:>= 11.0, < 11.22>= 12.0, < 12.17>= 13.0, < 13.13>= 14.0, < 14.10>= 15.0, < 15.5= 16.0
Codeready Linux Builder EusApplication
Affected:= 9.2
Codeready Linux Builder Eus For Power Little Endian EusApplication
Affected:= 9.0_ppc64le= 9.2_ppc64le
Codeready Linux Builder For Arm64 EusApplication
Affected:= 8.6_aarch64= 9.0_aarch64= 9.2_aarch64
Codeready Linux Builder For Ibm Z Systems EusApplication
Affected:= 9.0_s390x= 9.2_s390x
Codeready Linux Builder For Power Little Endian EusApplication
Affected:= 9.0_ppc64le= 9.2_ppc64le
Software CollectionsApplication
Affected:= 1.0
Enterprise LinuxOperating system
Affected:= 8.0= 9.0

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Determine installed PostgreSQL version
    Run 'psql --version' or 'SELECT version();' to obtain the exact PostgreSQL version number
    Affected if The version falls within any of these ranges: 11.0-11.21, 12.0-12.16, 13.0-13.12, 14.0-14.9, 15.0-15.4, or is exactly 16.0
  2. Check if PostgreSQL accepts network connections
    Examine postgresql.conf for 'listen_addresses' setting and pg_hba.conf for authentication rules. Run 'SHOW listen_addresses;' and review host-based authentication configuration
    Affected if listen_addresses is not set to localhost or pg_hba.conf allows non-local connections without restrictive authentication
  3. Verify database user authentication is properly restricted
    Review pg_hba.conf entries for 'trust', 'md5', or 'scram-sha-256' methods. Check for any overly permissive rules allowing remote authentication
    Affected if pg_hba.conf contains trust authentication for any non-local host or uses weak authentication methods accessible from untrusted networks

You are affected if your PostgreSQL version is in the vulnerable ranges AND the database is accessible to untrusted authenticated users via network connections.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 11.22 / 12.17 / 13.13 or later
Fixed in 11.2212.1713.13
Interim mitigation

Apply the PostgreSQL security update corresponding to this vulnerability. Since this requires authentication, ensure database credentials are properly secured and consider network-level restrictions on database access.

Recommended fix High confidence

PostgreSQL 14.10, 13.13, 12.17, or 11.22 (or later versions such as 15.x/16.x)

  1. 1. Backup your PostgreSQL database completely before starting any upgrade
  2. 2. Schedule maintenance window as upgrade requires service restart
  3. 3. For minor version upgrades (e.g., 14.9 to 14.10), use your system's package manager (yum, dnf, apt) to update the postgresql package
  4. 4. For major version upgrades (e.g., 13.x to 14.x), use pg_dumpall to export all databases or use pg_upgrade for in-place migration
  5. 5. After upgrading, restart the PostgreSQL service
  6. 6. Verify database functionality and check for any extension compatibility issues
  7. 7. Test that applications can connect and function properly
Caveat Major version upgrades may require application testing for SQL/functionality compatibility; always test in staging first

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in PostgreSQL Scoped from the published advisory
  • Consultation4.0 h
  • Implementation4.0 h
  • Testing8.0 h
  • Review / QA4.0 h
20.0 hours of engineering $3,440
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,504.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2023-5869 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2023-5869 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data