CVE-2023-48704

Unauthenticated heap buffer overflow in Gorrila codec decompression

State: Published
Severity: 7.0 High
Published: Dec 22, 2023
Updated: Aug 2, 2024
Reserved: Nov 17, 2023

Description

ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of Gorilla codec that crashes the ClickHouse server process. This attack does not require authentication. This issue has been addressed in ClickHouse Cloud version 23.9.2.47551 and ClickHouse versions 23.10.5.20, 23.3.18.15, 23.8.8.20, and 23.9.6.20.

Scores

CVSS	Score	Vector	Source
3.1	7.0 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H	GitHub_M

Weaknesses

CWE-122 Heap-based Buffer Overflow
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected Products

Product	Versions
ClickHouseClickHouse	< 23.9.2.47551Affected < 23.10.5.20Affected < 23.3.18.15Affected < 23.8.8.20Affected < 23.9.6.20Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.