CVE-2023-48298

CVE-2023-48298 affects ClickHouse, specifically the FPC codec decompression path. The issue is an integer underflow that can crash the server via a stack buffer overflow, exploitable by an unauthenticated attacker. The vulnerability is described as similar to CVE-2023-47118; no explicit remediati...

CVE-2024-22412

The CVE-2024-22412 issue affects ClickHouse: in cloud ClickHouse prior to 24.0.2.54535 and in ClickHouse 23.1, query caching can bypass role-based access controls, exposing data to users with a role who should be restricted. Affected versions' query cache behavior is described as not documented a...

CVE-2023-48704

The CVE-2023-48704 issue affects ClickHouse server and is caused by a heap buffer overflow in the Gorilla codec decompression logic. An unauthenticated attacker can send a crafted payload to the native interface (default port 9000/tcp) to crash the ClickHouse server. Public details in connected s...

CVE-2023-47118

ClickHouse CVE-2023-47118 is a heap buffer overflow in the server’s decompression logic (T64 codec) that can be triggered by sending a crafted payload to the native interface on port 9000/tcp or via HTTP with valid credentials. The issue allows unauthenticated remote exploitation through the nati...