CVE record · CVE-2023-5869

Postgresql: buffer overrun from integer overflow in array modification

CVSS 8.8 HighEPSS 0.043 · 91st percentile

Published by the CVE Program (CNA: redhat) at 10 Dec 2023, 17:56 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Red Hat	Red Hat Advanced Cluster Security 4.2 Package name: advanced-cluster-security/rhacs-central-db-rhel8 https://catalog.redhat.com/software/containers/	unaffected 4.2.4-6 to before * rpm Other versions: affected
Red Hat	Red Hat Advanced Cluster Security 4.2 Package name: advanced-cluster-security/rhacs-main-rhel8 https://catalog.redhat.com/software/containers/	unaffected 4.2.4-6 to before * rpm Other versions: affected
Red Hat	Red Hat Advanced Cluster Security 4.2 Package name: advanced-cluster-security/rhacs-operator-bundle https://catalog.redhat.com/software/containers/	unaffected 4.2.4-7 to before * rpm Other versions: affected
Red Hat	Red Hat Advanced Cluster Security 4.2 Package name: advanced-cluster-security/rhacs-scanner-db-rhel8 https://catalog.redhat.com/software/containers/	unaffected 4.2.4-6 to before * rpm Other versions: affected
Red Hat	Red Hat Advanced Cluster Security 4.2 Package name: advanced-cluster-security/rhacs-scanner-db-slim-rhel8 https://catalog.redhat.com/software/containers/	unaffected 4.2.4-7 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 7 Package name: postgresql https://access.redhat.com/downloads/content/package-browser/	unaffected 0:9.2.24-9.el7_9 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8 Package name: postgresql:13 https://access.redhat.com/downloads/content/package-browser/	unaffected 8090020231114113712.a75119d5 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8 Package name: postgresql:12 https://access.redhat.com/downloads/content/package-browser/	unaffected 8090020231128173330.a75119d5 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8 Package name: postgresql:10 https://access.redhat.com/downloads/content/package-browser/	unaffected 8090020231201202407.a75119d5 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8 Package name: postgresql:15 https://access.redhat.com/downloads/content/package-browser/	unaffected 8090020231114113548.a75119d5 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions Package name: postgresql:10 https://access.redhat.com/downloads/content/package-browser/	unaffected 8010020231130170510.c27ad7f8 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support Package name: postgresql:12 https://access.redhat.com/downloads/content/package-browser/	unaffected 8020020231128165246.4cda2c84 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support Package name: postgresql:10 https://access.redhat.com/downloads/content/package-browser/	unaffected 8020020231201202149.4cda2c84 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.2 Telecommunications Update Service Package name: postgresql:12 https://access.redhat.com/downloads/content/package-browser/	unaffected 8020020231128165246.4cda2c84 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.2 Telecommunications Update Service Package name: postgresql:10 https://access.redhat.com/downloads/content/package-browser/	unaffected 8020020231201202149.4cda2c84 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions Package name: postgresql:12 https://access.redhat.com/downloads/content/package-browser/	unaffected 8020020231128165246.4cda2c84 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions Package name: postgresql:10 https://access.redhat.com/downloads/content/package-browser/	unaffected 8020020231201202149.4cda2c84 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Package name: postgresql:12 https://access.redhat.com/downloads/content/package-browser/	unaffected 8040020231127153301.522a0ee4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Package name: postgresql:13 https://access.redhat.com/downloads/content/package-browser/	unaffected 8040020231127154806.522a0ee4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Package name: postgresql:10 https://access.redhat.com/downloads/content/package-browser/	unaffected 8040020231127142440.522a0ee4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service Package name: postgresql:12 https://access.redhat.com/downloads/content/package-browser/	unaffected 8040020231127153301.522a0ee4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service Package name: postgresql:13 https://access.redhat.com/downloads/content/package-browser/	unaffected 8040020231127154806.522a0ee4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service Package name: postgresql:10 https://access.redhat.com/downloads/content/package-browser/	unaffected 8040020231127142440.522a0ee4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Package name: postgresql:12 https://access.redhat.com/downloads/content/package-browser/	unaffected 8040020231127153301.522a0ee4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Package name: postgresql:13 https://access.redhat.com/downloads/content/package-browser/	unaffected 8040020231127154806.522a0ee4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Package name: postgresql:10 https://access.redhat.com/downloads/content/package-browser/	unaffected 8040020231127142440.522a0ee4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Package name: postgresql:13 https://access.redhat.com/downloads/content/package-browser/	unaffected 8060020231114115246.ad008a3a to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Package name: postgresql:12 https://access.redhat.com/downloads/content/package-browser/	unaffected 8060020231128165328.ad008a3a to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Package name: postgresql:10 https://access.redhat.com/downloads/content/package-browser/	unaffected 8060020231201202249.ad008a3a to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support Package name: postgresql:13 https://access.redhat.com/downloads/content/package-browser/	unaffected 8080020231114105206.63b34585 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support Package name: postgresql:12 https://access.redhat.com/downloads/content/package-browser/	unaffected 8080020231128165335.63b34585 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support Package name: postgresql:10 https://access.redhat.com/downloads/content/package-browser/	unaffected 8080020231201202316.63b34585 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support Package name: postgresql:15 https://access.redhat.com/downloads/content/package-browser/	unaffected 8080020231113134015.63b34585 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9 Package name: postgresql https://access.redhat.com/downloads/content/package-browser/	unaffected 0:13.13-1.el9_3 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9 Package name: postgresql:15 https://access.redhat.com/downloads/content/package-browser/	unaffected 9030020231120082734.rhel9 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support Package name: postgresql https://access.redhat.com/downloads/content/package-browser/	unaffected 0:13.13-1.el9_0 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support Package name: postgresql https://access.redhat.com/downloads/content/package-browser/	unaffected 0:13.13-1.el9_2 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support Package name: postgresql:15 https://access.redhat.com/downloads/content/package-browser/	unaffected 9020020231115020618.rhel9 to before * rpm Other versions: affected
Red Hat	Red Hat Software Collections for Red Hat Enterprise Linux 7 Package name: rh-postgresql12-postgresql https://access.redhat.com/downloads/content/package-browser/	unaffected 0:12.17-1.el7 to before * rpm Other versions: affected
Red Hat	Red Hat Software Collections for Red Hat Enterprise Linux 7 Package name: rh-postgresql10-postgresql https://access.redhat.com/downloads/content/package-browser/	unaffected 0:10.23-2.el7 to before * rpm Other versions: affected

And 14 more products. The full list is on the CVE record.

Identifiers: CVE-2023-5869
CNA: redhat
Weakness (CWE): CWE-190
Tags: Red Hat Advanced Cluster Security 4.2
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions
Red Hat Enterprise Linux 8.2 Advanced Update Support
Red Hat Enterprise Linux 8.2 Telecommunications Update Service
Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Memory corruption
Published: 10 Dec 2023
Updated: 4 Nov 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
8.8	High	3.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CNA (redhat)

CISA KEV Not listed.
EPSS 0.043, the 91st percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

10 Dec 2023, 17:56 UTC Confirmed by the CVE List
10 Dec 2023, 18:15 UTC Confirmed by NVD

Sources

References from the CNA

access.redhat.com/errata/RHSA-2023:7545 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7579 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7580 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7581 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7616 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7656 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7666 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7667 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7694 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7695 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7714 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7770 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7771 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7772 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7778 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7783 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7784 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7785 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7786 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7788 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7789 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7790 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7878 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7883 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7884 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7885 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2024:0304 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2024:0332 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2024:0337 vendor-advisoryredhat
access.redhat.com/security/cve/CVE-2023-5869 vdb-entryredhat

And 3 more on the CVE record.

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.