CVE-2023-48298: Integer underflow leading to stack overflow in FPC codec decompression
ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. This vulnerability is an integer underflow resulting in crash due to stack buffer overflow in decompression of FPC codec. It can be triggered and exploited by an unauthenticated attacker. The vulnerability is very similar to CVE-2023-47118 with how the vulnerable function can be exploited.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-48298?
CVE-2023-48298 has been classified as a high-severity vulnerability due to its potential to cause system crashes.
How do I fix CVE-2023-48298?
To fix CVE-2023-48298, you should update ClickHouse to the latest version that addresses this vulnerability.
What does CVE-2023-48298 affect?
CVE-2023-48298 affects specific versions of ClickHouse, including versions from 23.3 up to 23.10.4.25.
What can be exploited in CVE-2023-48298?
CVE-2023-48298 can be exploited through an integer underflow that leads to a stack buffer overflow.
Is CVE-2023-48298 present in ClickHouse Cloud?
Yes, CVE-2023-48298 is present in ClickHouse Cloud for the affected versions up to 23.9.2.47475.