CVE-2023-41113: Medium severity EnterpriseDB Advanced Server vulnerability
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It allows an authenticated user to to obtain information about whether certain files exist on disk, what errors if any occur when attempting to read them, and some limited information about their contents (regardless of permissions). This can occur when a superuser has configured one or more directories for filesystem access via CREATE DIRECTORY and adopted certain non-default settings for loglineprefix and logconnections.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-41113?
CVE-2023-41113 has been classified as having a medium severity due to the potential information disclosure.
How do I fix CVE-2023-41113?
To fix CVE-2023-41113, upgrade to EnterpriseDB Postgres Advanced Server versions 11.21.32, 12.16.20, 13.12.16, 14.9.0, or 15.4.0 or later.
What does CVE-2023-41113 allow an attacker to do?
CVE-2023-41113 allows an authenticated user to obtain information about the existence of certain files on disk.
What versions of EnterpriseDB Postgres Advanced Server are affected by CVE-2023-41113?
CVE-2023-41113 affects EnterpriseDB Postgres Advanced Server versions prior to 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0.
Is a patch available for CVE-2023-41113?
Yes, a patch is available in the form of updated versions of EnterpriseDB Postgres Advanced Server, which should be deployed as soon as possible.