Heap buffer overflow in T64 codec decompression

CVE-2023-47118

What is CVE-2023-47118?

A heap buffer overflow vulnerability has been identified in ClickHouse, an open-source column-oriented database management system. This flaw arises from a bug in the decompression logic of the T64 codec, which can be triggered by an attacker sending a specially crafted payload to ClickHouse's native interface (default port 9000/tcp). Notably, this attack does not require any authentication, making it particularly concerning. While the exploit can also be executed via the HTTP protocol, it requires valid credentials due to the authentication step. This vulnerability has been addressed in the following versions: 23.10.2.13-stable, 23.9.4.11-stable, 23.8.6.16-lts, and 23.3.16.7-lts.

References