CVE-2021-42387: High severity clickhouse vulnerability
Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the upper bounds of the source of the copy operation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-42387?
CVE-2021-42387 is considered a high severity vulnerability due to the potential for heap out-of-bounds reads.
How do I fix CVE-2021-42387?
To fix CVE-2021-42387, update ClickHouse to versions 18.16.1+ds-7.2+deb11u1, 18.16.1+ds-7.3, or 18.16.1+ds-7.4.
Which versions of ClickHouse are affected by CVE-2021-42387?
CVE-2021-42387 affects versions of ClickHouse prior to 21.10.2.15.
What type of vulnerability is CVE-2021-42387?
CVE-2021-42387 is a heap out-of-bounds read vulnerability that may allow attackers to exploit the LZ4 compression codec.
Can CVE-2021-42387 lead to denial of service?
Yes, CVE-2021-42387 may lead to denial of service if exploited successfully.