CVE-2021-43305

Published: 14 March 2022

Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don’t exceed the destination buffer’s limits. This issue is very similar to CVE-2021-43304, but the vulnerable copy operation is in a different wildCopy call.

Priority

Cvss 3 Severity Score

8.8

Score breakdown

Status

Package	Release	Status
clickhouse Launchpad, Ubuntu, Debian	focal	Released (18.16.1+ds-7ubuntu0.1)
	impish	Ignored (end of life)
	lunar	Ignored (end of life, was needs-triage)
	mantic	Ignored (end of life, was needs-triage)
	noble	Not vulnerable (18.16.1+ds-7.4build2)
	upstream	Released (18.16.1+ds-7.4)

Severity score breakdown

Parameter	Value
Base score	8.8
Attack vector	Network
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Bugs

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1008216

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›