UpHeron
All vulnerabilities

Servers and applications

CVE-2023-48298

Unauthenticated Integer underflow leading to stack overflow in FPC codec decompression

Severity
High 7.5
Published
18 Dec 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
23.3.17.13, 23.8.7.24, 23.9.2.47475, 23.9.5.29, 23.10.4.25
Also known as
GHSA-qw9f-qv29-8938
Sources
NVD, Project advisories (GitHub)

Description

ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. This vulnerability is an integer underflow resulting in crash due to stack buffer overflow in decompression of FPC codec. It can be triggered and exploited by an unauthenticated attacker. The vulnerability is very similar to CVE-2023-47118 with how the vulnerable…

Affected software

SoftwareAffected versions
ClickHouseServers and applications · cpe:a:clickhouse:clickhouse
  • From 23.3 up to 23.3.17.13
  • From 23.8 up to 23.8.7.24
  • From 23.9 up to 23.9.5.29
  • From 23.10 up to 23.10.4.25
ClickHouseServers and applications · github:clickhouse/clickhouse
  • Every version before 23.10.4.25
  • Every version before 23.9.5.29
  • Every version before 23.8.7.24
  • Every version before 23.3.17.13
  • Every version before 23.9.2.47475

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-48298
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-48298
  • GitHub Advisory Database https://github.com/advisories/GHSA-qw9f-qv29-8938
  • github.com https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-qw9f-qv29-8938