CVE-2023-48298

ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. This vulnerability is an integer underflow resulting in crash due to stack buffer overflow in decompression of FPC codec. It can be triggered and exploited by an unauthenticated attacker. The vulnerability is very similar to CVE-2023-47118 with how the vulnerable function can be exploited.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*
cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*
cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*
cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*
cpe:2.3:a:clickhouse:clickhouse_cloud:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:31

Type Values Removed Values Added
References () https://github.com/ClickHouse/ClickHouse/pull/56795 - Patch () https://github.com/ClickHouse/ClickHouse/pull/56795 - Patch
References () https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-qw9f-qv29-8938 - Vendor Advisory () https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-qw9f-qv29-8938 - Vendor Advisory
CVSS v2 : unknown
v3 : 7.5
v2 : unknown
v3 : 5.9

03 Jan 2024, 02:23

Type Values Removed Values Added
References () https://github.com/ClickHouse/ClickHouse/pull/56795 - () https://github.com/ClickHouse/ClickHouse/pull/56795 - Patch
References () https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-qw9f-qv29-8938 - () https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-qw9f-qv29-8938 - Vendor Advisory
CPE cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*
cpe:2.3:a:clickhouse:clickhouse_cloud:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 5.9
v2 : unknown
v3 : 7.5
First Time Clickhouse
Clickhouse clickhouse Cloud
Clickhouse clickhouse

22 Dec 2023, 12:18

Type Values Removed Values Added
Summary
  • (es) ClickHouse® es un sistema de gestión de bases de datos orientado a columnas de código abierto que permite generar informes de datos analíticos en tiempo real. Esta vulnerabilidad es un desbordamiento insuficiente de enteros que provoca un bloqueo debido al desbordamiento de búfer de pila en la descompresión del códec FPC. Puede ser desencadenado y explotado por un atacante no autenticado. La vulnerabilidad es muy similar a CVE-2023-47118 en cuanto a cómo se puede explotar la función vulnerable.

21 Dec 2023, 23:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-12-21 23:15

Updated : 2024-11-21 08:31


NVD link : CVE-2023-48298

Mitre link : CVE-2023-48298

CVE.ORG link : CVE-2023-48298


JSON object : View

Products Affected

clickhouse

  • clickhouse
  • clickhouse_cloud
CWE
CWE-191

Integer Underflow (Wrap or Wraparound)