Detections
Analytics
Alpine: multiple postgresql16 packages: security update to 16.1-r0
high Tenable Self-Hosted Container Security Plugin ID 408150
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive
information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling
'unknown'-type values from string literals without type designation can disclose bytes, potentially
revealing notable and confidential information. This issue exists due to excessive data output in
aggregate function calls, enabling remote users to read some portion of system memory. (CVE-2023-5868)
- A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through
missing overflow checks during SQL array value modification. This issue exists due to an integer overflow
during array modification where a remote user can trigger the overflow by providing specially crafted
data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary
bytes to memory and extensively read the server's memory. (CVE-2023-5869)
- A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers,
including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful
exploitation requires a non-core extension with a less-resilient background worker and would affect that
specific background worker only. This issue may allow a remote high privileged user to launch a denial of
service (DoS) attack. (CVE-2023-5870)
See Also
https://security.alpinelinux.org/vuln/CVE-2023-5868
Plugin Details
Severity: High
ID: 408150
Version: Revision 1.32
Type: Local
Published: 12/7/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: High
Score: 7.6
Percentile: 98.48
CVSS v2
Risk Factor: High
Base Score: 9
Temporal Score: 6.7
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2023-5869
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 11/9/2023
Reference Information
CVE: CVE-2023-5868, CVE-2023-5869, CVE-2023-5870
IAVB: 2023-B-0088-S