High severity · published Dec 22, 2023
CVE-2023-48704
ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of Gorilla codec that crashes the ClickHouse server process. This attack does not require authentication. This issue has been addressed in ClickHouse Cloud version 23.9.2.47551 and ClickHouse versions 23.10.5.20, 23.3.18.15, 23.8.8.20, and 23.9.6.20.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
Clickhouse · Clickhouse
23.3 before 23.3.18.15; 23.8 before 23.8.8.20; 23.9 before 23.9.6.20; 23.10 before 23.10.5.20 · source: NVD
CC
Clickhouse Cloud · Clickhouse
before 23.9.2.47551 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-48704
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-48704
Patch
https://github.com/ClickHouse/ClickHouse/pull/57107
Vendor Advisory
https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-5rmf-5g48-xv63
More from Clickhouse
9.8
CVE-2026-111497
Out-of-Bounds Write in Google Brotli Decoder
9.8
CVE-2023-47118
ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time
9.8
CVE-2019-16535
In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve RCE or DoS via native protocol
9.8
CVE-2018-14671
In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability
9.8
CVE-2018-14670
Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database