CVE-2021-43304: Buffer Overflow
Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copyamount>(op, ip, copyend), don’t exceed the destination buffer’s limits.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-43304?
CVE-2021-43304 is classified as a high severity vulnerability due to the potential for a heap buffer overflow.
How do I fix CVE-2021-43304?
To fix CVE-2021-43304, update Clickhouse to version 21.10.2.15 or newer, or apply the relevant patches provided by your distribution.
What software is affected by CVE-2021-43304?
CVE-2021-43304 affects ClickHouse versions prior to 21.10.2.15 and specific versions of the Clickhouse package in Debian.
What kind of attack can exploit CVE-2021-43304?
CVE-2021-43304 can be exploited by attackers utilizing malicious queries to trigger a heap buffer overflow.
What is the potential impact of CVE-2021-43304?
The potential impact of CVE-2021-43304 includes the possibility of remote code execution or denial of service being achieved via exploited applications.