CVE-2024-6873: Specially crafted request could caused undefined behaviour which may lead to Remote Code Execution.
It is possible to crash or redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to the ClickHouse server native interface. This redirection is limited to what is available within a 256-byte range of memory at the time of execution, and no known remote code execution (RCE) code has been produced or exploited.
Fixes have been merged to all currently supported version of ClickHouse. If you are maintaining your own forked version of ClickHouse or using an older version and cannot upgrade, the fix for this vulnerability can be found in this commit https://github.com/ClickHouse/ClickHouse/pull/64024 .
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6873?
CVE-2024-6873 is classified with high severity due to its potential to crash or redirect execution flow in the ClickHouse server.
How do I fix CVE-2024-6873?
To mitigate CVE-2024-6873, ensure that you are using the latest supported version of ClickHouse, which includes security patches.
Who is affected by CVE-2024-6873?
CVE-2024-6873 affects all current supported versions of the ClickHouse server.
Can CVE-2024-6873 be exploited remotely?
Yes, CVE-2024-6873 can be exploited remotely by sending a specially crafted request to the ClickHouse server's native interface.
What are the potential consequences of CVE-2024-6873?
The potential consequences of CVE-2024-6873 include crashing the ClickHouse server or redirecting the execution flow, which can lead to service disruption.