CVE-2023-48298CWE-191

Integer underflow leading to stack overflow in FPC codec decompression

Medium · published December 21, 2023

CVSS v3.1
5.9
EPSS
1%
Percentile
49.7
In the wild
Unconfirmed
What it is

ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. This vulnerability is an integer underflow resulting in crash due to stack buffer overflow in decompression of FPC codec. It can be triggered and exploited by an unauthenticated attacker. The vulnerability is very similar to CVE-2023-47118 with how the vulnerable function can be exploited.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00634 · 49.7th percentile
Weakness
CWE-191 · Integer Underflow (Wrap or Wraparound)
Published
2023-12-21T23:07Z
EPSS history
Timeline
  • 21 DEC 23:07Z
    Integer underflow leading to stack overflow in FPC codec decompression
    cvelistv5