USN-6933-1: ClickHouse vulnerabilities

Releases

• Ubuntu 20.04 LTS

Packages

• clickhouse - column-oriented database system (cli client)

Details

It was discovered that ClickHouse incorrectly handled memory, leading to a
heap out-of-bounds data read. An attacker could possibly use this issue to
cause a denial of service, or leak sensitive information.
(CVE-2021-42387, CVE-2021-41388)

It was discovered that ClickHouse incorrectly handled memory, leading to a
heap-based buffer overflow. An attacker could possibly use this issue to
cause a denial of service, or execute arbitrary code. (CVE-2021-43305)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 20.04

• clickhouse-common - 18.16.1+ds-7ubuntu0.1
• clickhouse-server - 18.16.1+ds-7ubuntu0.1
• clickhouse-tools - 18.16.1+ds-7ubuntu0.1

In general, a standard system update will make all the necessary changes.

References

• CVE-2021-42388
• CVE-2021-43305
• CVE-2021-42387