UBUNTU-CVE-2023-48704

Source
https://ubuntu.com/security/CVE-2023-48704
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-48704.json
JSON Data
https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2023-48704
Related
Published
2023-12-22T16:15:00Z
Modified
2025-01-13T10:24:25Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of Gorilla codec that crashes the ClickHouse server process. This attack does not require authentication. This issue has been addressed in ClickHouse Cloud version 23.9.2.47551 and ClickHouse versions 23.10.5.20, 23.3.18.15, 23.8.8.20, and 23.9.6.20.

References

Affected packages

Ubuntu:20.04:LTS / clickhouse

Package

Name
clickhouse
Purl
pkg:deb/ubuntu/clickhouse@18.16.1+ds-7ubuntu0.1?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

18.*

18.16.1+ds-5
18.16.1+ds-5ubuntu1
18.16.1+ds-5ubuntu2
18.16.1+ds-6ubuntu1
18.16.1+ds-7
18.16.1+ds-7ubuntu0.1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / clickhouse

Package

Name
clickhouse
Purl
pkg:deb/ubuntu/clickhouse@18.16.1+ds-7.4build2?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

18.*

18.16.1+ds-7.4
18.16.1+ds-7.4build1
18.16.1+ds-7.4build2

Ecosystem specific

{
    "ubuntu_priority": "medium"
}