Buffer Overflow Vulnerability in ClickHouse by ClickHouse
CVE-2024-41436

7.5HIGH

Key Information:

Vendor

ClickHouse

Status
ClickHouse
Vendor
CVE Published:
3 September 2024

What is CVE-2024-41436?

A buffer overflow vulnerability has been identified in ClickHouse version 24.3.3.102, specifically within the DB::evaluateConstantExpressionImpl component. Exploitation of this vulnerability could potentially allow an attacker to execute arbitrary code, leading to unauthorized data access or manipulation. It is crucial for users of the affected version to apply patches or updates promptly to mitigate any security risks.

References

https://github.com/ClickHouse/ClickHouse/issues/65520
https://gist.github.com/ycybfhb/db127ae9d105a4d20edc9f010...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.