CVE-2021-42388
High
Description
Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the lower bounds of the source of the copy operation.
SeverityHigh
CVSS8.1
Exploit probability—
Product
Clickhouse
PublishedMar 14, 2022
First seenMar 14, 2022
Weakness typeCWE-125Out-of-bounds read
How to fix
Update
- clickhouse clickhouse21.10.2.15 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| clickhouse clickhouse | v < 21.10.2.15 | 21.10.2.15 |
| debian debian_linux | 10.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.