CVE-2023-47118 is a critical heap buffer overflow vulnerability affecting ClickHouse server, an open-source column-oriented database management system. An unauthenticated attacker can crash the ClickHouse server process by sending a specially crafted payload to the native interface on port 9000/tcp, exploiting a bug in the T64 codec's decompression logic. This vulnerability has a CVSS score of 9.8 (Critical) due to its network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While no active exploitation, public exploit code, or significant community discussion has been observed, the issue has been patched in versions 23.10.2.13-stable, 23.9.4.11-stable, 23.8.6.16-lts, and 23.3.16.7-lts.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 23.3, < 23.3.16.7CPE matchmatch criteria | cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:lts:*:*:* | ||
>= 23.8, < 23.8.6.16CPE matchmatch criteria | cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:lts:*:*:* | ||
>= 23.9, < 23.9.4.11CPE matchmatch criteria | cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:* | ||
>= 23.10, < 23.10.2.13CPE matchmatch criteria | cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:* | ||
< 23.9.2.47475CPE matchmatch criteria | cpe:2.3:a:clickhouse:clickhouse_cloud:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.