Clickhouse
CVE-2023-48298
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. This vulnerability is an integer underflow resulting in crash due to stack buffer overflow in decompression of FPC codec. It can be triggered and exploited by an unauthenticated attacker. The vulnerability is very similar to CVE-2023-47118 with how the vulnerable function can be exploited.
AnalysisAI
ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Technical ContextAI
This vulnerability is classified under CWE-191. ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. This vulnerability is an integer underflow resulting in crash due to stack buffer overflow in decompression of FPC codec. It can be triggered and exploited by an unauthenticated attacker. The vulnerability is very similar to CVE-2023-47118 with how the vulnerable function can be exploited. Affected products include: Clickhouse, Clickhouse Clickhouse Cloud.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Clickhouse
View allExposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and co
ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl.
ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports
In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can
ClickHouse is an open-source column-oriented database management system. Rated medium severity (CVSS 4.9), this vulnerab
Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3. Rated
ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports i
In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a cust
When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious externa
ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function. Rated medium severity (CVSS 5.3),
Same weakness CWE-191 – Integer Underflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today