CVE-2023-48298: fallo de gravedad media en ClickHouse
Integer underflow leading to stack overflow in FPC codec decompression
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.9epss 0.6%
ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. This vulnerability is an integer underflow resulting in crash due to stack buffer overflow in decompression of FPC codec. It can be triggered and exploited by an unauthenticated attacker. The vulnerability is very similar to CVE-2023-47118 with how the vulnerable function can be exploited.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
ClickHouse · ClickHouseCVEs relacionadas — ClickHouse
En el mismo producto, de las más peligrosas a las menos.
CVE-2018-14671—CVE-2018-14671EPSS 3.4%CVE-2018-14670—CVE-2018-14670EPSS 1.8%CVE-2026-116366CRITICALUnauthenticated RCE vulnerability against ClickHouse ServerEPSS 1.0%CVE-2024-6873HIGHSpecially crafted request could caused undefined behaviour which may lead to Remote Code Execution.EPSS 0.7%CVE-2024-22412LOWClickHouse's Role-based Access Control is bypassed when query caching is enabled.EPSS 0.6%CVE-2023-48704HIGHUnauthenticated heap buffer overflow in Gorrila codec decompressionEPSS 0.5%