x/vulndb: potential Go vuln in github.com/ClickHouse/ClickHouse: CVE-2023-47118

[GoVulnBot]

CVE-2023-47118 references github.com/ClickHouse/ClickHouse, which may be a Go module.

Description:
ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of T64 codec that crashes the ClickHouse server process. This attack does not require authentication. Note that this exploit can also be triggered via HTTP protocol, however, the attacker will need a valid credential as the HTTP authentication take places first. This issue has been fixed in version 23.10.2.13-stable, 23.9.4.11-stable, 23.8.6.16-lts and 23.3.16.7-lts.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-47118
• JSON: https://github.com/CVEProject/cvelist/tree/ee8aed246c5762754e56ae3c25c592159d10a5a7/2023/47xxx/CVE-2023-47118.json
• advisory: GHSA-g22g-p6q2-x39v
• Imported by: https://pkg.go.dev/github.com/ClickHouse/ClickHouse?tab=importedby

Cross references:

• Module github.com/ClickHouse/ClickHouse appears in issue x/vulndb: potential Go vuln in github.com/ClickHouse/ClickHouse: CVE-2019-18657 #2246 LEGACY_FALSE_POSITIVE

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/ClickHouse/ClickHouse
      vulnerable_at: 21.1.0-testing+incompatible
      packages:
        - package: ClickHouse
cves:
    - CVE-2023-47118
references:
    - advisory: https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-g22g-p6q2-x39v

[jba]

The GHSA references the fixing PR, which does not include any Go code.

In fact, there doesn't seem to be any Go code in the repo, except for some diagnostic tools.

[gopherbot]

Change https://go.dev/cl/553636 mentions this issue: data/excluded: batch add 6 excluded reports