CVE-2023-48704
published 2023-12-22CVE-2023-48704: ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.50%
38.7th percentile
ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of Gorilla codec that crashes the ClickHouse server process. This attack does not require authentication. This issue has been addressed in ClickHouse Cloud version 23.9.2.47551 and ClickHouse versions 23.10.5.20, 23.3.18.15, 23.8.8.20, and 23.9.6.20.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| clickhouse | clickhouse | < 23.9.2.47551 | 23.9.2.47551 |
| clickhouse | clickhouse | < 23.10.5.20 | 23.10.5.20 |
| clickhouse | clickhouse | < 23.3.18.15 | 23.3.18.15 |
| clickhouse | clickhouse | < 23.8.8.20 | 23.8.8.20 |
| clickhouse | clickhouse | < 23.9.6.20 | 23.9.6.20 |
| clickhouse | clickhouse | >= 23.10 < 23.10.5.20 | 23.10.5.20 |
| clickhouse | clickhouse | >= 23.3 < 23.3.18.15 | 23.3.18.15 |
| clickhouse | clickhouse | >= 23.8 < 23.8.8.20 | 23.8.8.20 |
| clickhouse | clickhouse | >= 23.9 < 23.9.6.20 | 23.9.6.20 |
| clickhouse | clickhouse_cloud | < 23.9.2.47551 | 23.9.2.47551 |
| debian | clickhouse | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2023-48704: clickhouse - ClickHouse is an open-source column-oriented database management system that all...
vendor_debian·2023·CVSS 7.0
CVE-2023-48704 [HIGH] CVE-2023-48704: clickhouse - ClickHouse is an open-source column-oriented database management system that all...
ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of Gorilla codec that crashes the ClickHouse server process. This attack does not require authentication. This issue has been addressed in ClickHouse Cloud version 23.9.2.47551 and ClickHouse versions 23.10.5.20, 23.3.18.15, 23.8.8.20, and 23.9.6.20.
Scope: local
bookworm: resolved
bullseye: resolved
OSV
CVE-2023-48704: ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time
osv·2023-12-22·CVSS 7.5
CVE-2023-48704 [HIGH] CVE-2023-48704: ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time
ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of Gorilla codec that crashes the ClickHouse server process. This attack does not require authentication. This issue has been addressed in ClickHouse Cloud version 23.9.2.47551 and ClickHouse versions 23.10.5.20, 23.3.18.15, 23.8.8.20, and 23.9.6.20.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-12-22
Published