« Back to list

CVE-2023-48298

Status: ModifiedHigh (7.5)—

ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. This vulnerability is an integer underflow resulting in crash due to stack buffer overflow in decompression of FPC codec. It can be triggered and exploited by an unauthenticated attacker. The vulnerability is very similar to CVE-2023-47118 with how the vulnerable function can be exploited.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (2)

Clickhouse — ClickhouseClickhouse — Clickhouse Cloud

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2023-48298",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-48298",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-27T15:47:32.929815Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "ClickHouse",
          "product": "ClickHouse",
          "versions": [
            {
              "status": "affected",
              "version": "<= 23.10.2.14"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-12-21T23:15:09.047",
  "references": [
    {
      "url": "https://github.com/ClickHouse/ClickHouse/pull/56795",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-qw9f-qv29-8938",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/ClickHouse/ClickHouse/pull/56795",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-qw9f-qv29-8938",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-191"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. This vulnerability is an integer underflow resulting in crash due to stack buffer overflow in decompression of FPC codec. It can be triggered and exploited by an unauthenticated attacker. The vulnerability is very similar to CVE-2023-47118 with how the vulnerable function can be exploited.\n"
    },
    {
      "lang": "es",
      "value": "ClickHouse® es un sistema de gestión de bases de datos orientado a columnas de código abierto que permite generar informes de datos analíticos en tiempo real. Esta vulnerabilidad es un desbordamiento insuficiente de enteros que provoca un bloqueo debido al desbordamiento de búfer de pila en la descompresión del códec FPC. Puede ser desencadenado y explotado por un atacante no autenticado. La vulnerabilidad es muy similar a CVE-2023-47118 en cuanto a cómo se puede explotar la función vulnerable."
    }
  ],
  "lastModified": "2026-06-17T06:33:57.247",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BA3ACE71-E086-4AE4-99EE-42AD774EED64",
              "versionEndIncluding": "23.3.17.13",
              "versionStartIncluding": "23.3"
            },
            {
              "criteria": "cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A32881DE-F775-4AC0-A88D-9BC7885D116E",
              "versionEndIncluding": "23.8.7.24",
              "versionStartIncluding": "23.8"
            },
            {
              "criteria": "cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "65BDEEEB-BC9D-4AA5-BE72-D0C67A88A3FA",
              "versionEndIncluding": "23.9.5.29",
              "versionStartIncluding": "23.9"
            },
            {
              "criteria": "cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2CAC16B5-C710-4F5F-9E65-27E260D110A5",
              "versionEndIncluding": "23.10.4.25",
              "versionStartIncluding": "23.10"
            },
            {
              "criteria": "cpe:2.3:a:clickhouse:clickhouse_cloud:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3D2CD6AA-64F5-4D44-B0CA-69A1F4416E16",
              "versionEndIncluding": "23.9.2.47475",
              "versionStartIncluding": "23.9"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}