CVE-2022-44010: Buffer Overflow
An issue was discovered in ClickHouse before 22.9.1.2603. An attacker could send a crafted HTTP request to the HTTP Endpoint (usually listening on port 8123 by default), causing a heap-based buffer overflow that crashes the process. This does not require authentication. The fixed versions are 22.9.1.2603, 22.8.2.11, 22.7.4.16, 22.6.6.16, and 22.3.12.19.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-44010?
CVE-2022-44010 is a vulnerability discovered in ClickHouse before version 22.9.1.2603, where an attacker can send a crafted HTTP request that causes a heap-based buffer overflow and crashes the process without authentication.
Is authentication required to exploit CVE-2022-44010?
No, authentication is not required to exploit CVE-2022-44010.
How does CVE-2022-44010 affect ClickHouse?
CVE-2022-44010 affects ClickHouse versions prior to 22.9.1.2603, allowing an attacker to crash the process by sending a specially crafted HTTP request.
What is the severity of CVE-2022-44010?
CVE-2022-44010 has a severity value of 7.5, which is considered high.
How can CVE-2022-44010 be fixed?
To fix CVE-2022-44010, users should upgrade to ClickHouse version 22.9.1.2603 or later.