Integer underflow leading to stack overflow in FPC codec decompression
CVE-2023-48298

5.9MEDIUM

Key Information:

Vendor

Clickhouse

Status
Clickhouse
Vendor
CVE Published:
21 December 2023

What is CVE-2023-48298?

ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. This vulnerability is an integer underflow resulting in crash due to stack buffer overflow in decompression of FPC codec. It can be triggered and exploited by an unauthenticated attacker. The vulnerability is very similar to CVE-2023-47118 with how the vulnerable function can be exploited.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

ClickHouse <= 23.10.2.14

References

https://github.com/ClickHouse/ClickHouse/security/advisor...
x_refsource_CONFIRM
https://github.com/ClickHouse/ClickHouse/pull/56795
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.