CVE-2021-43305: Buffer Overflow
Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copyamount>(op, ip, copyend), don’t exceed the destination buffer’s limits. This issue is very similar to CVE-2021-43304, but the vulnerable copy operation is in a different wildCopy call.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-43305?
CVE-2021-43305 is classified as a high severity vulnerability due to its potential for allowing arbitrary code execution.
How do I fix CVE-2021-43305?
To resolve CVE-2021-43305, upgrade ClickHouse to version 21.10.2.15 or later.
What systems are affected by CVE-2021-43305?
CVE-2021-43305 affects ClickHouse versions prior to 21.10.2.15 and Debian GNU/Linux version 10.0.
What kind of vulnerability is CVE-2021-43305?
CVE-2021-43305 is a heap buffer overflow vulnerability that occurs when parsing malicious queries.
Can CVE-2021-43305 lead to data breaches?
Yes, exploitation of CVE-2021-43305 can potentially lead to unauthorized access and data breaches.