CVE-2023-48298: clickhouse +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2023-48298

CVSS 7.5 · High EPSS 0,63%

Kerentanan Integer Underflow (Wrap or Wraparound) pada clickhouse, clickhouse cloud. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. This vulnerability is an integer underflow resulting in crash due to stack buffer overflow in decompression of FPC codec. It can be triggered and exploited by an unauthenticated attacker. The vulnerability is very similar to CVE-2023-47118 with how the vulnerable function can be exploited.

Rincian

Terbit di NVD: 21 Desember 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-191: Integer Underflow (Wrap or Wraparound)
EPSS (30 hari): 0,63% peluang dieksploitasi; lebih tinggi dari 48,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
clickhouse	clickhouse	Versi 23.3 hingga 23.3.17.13
clickhouse	clickhouse	Versi 23.8 hingga 23.8.7.24
clickhouse	clickhouse	Versi 23.9 hingga 23.9.5.29
clickhouse	clickhouse	Versi 23.10 hingga 23.10.4.25
clickhouse	clickhouse cloud	Versi 23.9 hingga 23.9.2.47475

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-qw9f-qv29-8938 advisory vendor
https://github.com/ClickHouse/ClickHouse/pull/56795 patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.