CVE-2021-42390: Divide by Zero
Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-42390?
CVE-2021-42390 has been classified as a high-severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2021-42390?
To fix CVE-2021-42390, upgrade to ClickHouse version 21.10.2.15 or later, where the vulnerability has been addressed.
What causes CVE-2021-42390?
CVE-2021-42390 is caused by a divide-by-zero error in the DeltaDouble compression codec when processing a maliciously crafted query.
Which software versions are affected by CVE-2021-42390?
CVE-2021-42390 affects all versions of ClickHouse up to, but not including, 21.10.2.15.
What impact does CVE-2021-42390 have on ClickHouse?
CVE-2021-42390 can lead to a denial of service condition, disrupting the availability of ClickHouse services.