Back to Vulnerability Directory
HIGHFixed upstream

CVE-2023-48298

ClickHouse: unauthenticated integer underflow in the FPC codec

Technology

ClickHouse

CVSS Score

7.5 / 10.0

Affected Versions

ClickHouse before 23.3.17.13, 23.8 before 23.8.7.24, 23.9 before 23.9.5.29, 23.10 before 23.10.4.25

Upstream Fix

23.3.17.13, 23.8.7.24, 23.9.5.29, 23.10.4.25

Published

December 21, 2023

OSSeva Coverage

Fixed upstream

Description

An integer underflow in the FPC compression codec lets an attacker crash the server process without authentication.

Upstream record: NVD · CVE.org

Is your ClickHouse deployment affected?

If you're running ClickHouse before 23.3.17.13, 23.8 before 23.8.7.24, 23.9 before 23.9.5.29, 23.10 before 23.10.4.25, you need this patch. Book a discovery call to get covered.

Book a discovery callView ClickHouse coverage →