Unauthenticated heap buffer overflow in Gorrila codec decompression

CVE-2023-48704

What is CVE-2023-48704?

A heap buffer overflow vulnerability has been identified in ClickHouse, an open-source column-oriented database management system. This flaw resides in the decompression logic of the Gorilla codec, which can be exploited through a specially crafted payload sent to the default native interface on port 9000/tcp. Successfully executing this attack can crash the ClickHouse server process, and importantly, it does not require any form of authentication. This issue has been addressed in several versions of ClickHouse, ensuring improved security for users.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References