CVE-2021-42388

HIGH

Clickhouse < 21.10.2.15 - Heap Out-of-bounds Read in LZ4 Decompression

Title source: llm
STIX 2.1

Description

Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the lower bounds of the source of the copy operation.

References (2)

Core 2
Core References
Mailing List, Third Party Advisory mailing-list
https://lists.debian.org/debian-lts-announce/2022/11/msg00002.html

Scores

CVSS v3 8.1
EPSS 0.0155
EPSS Percentile 72.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Details

CWE
CWE-125
Status published
Products (2)
clickhouse/clickhouse < 21.10.2.15
debian/debian_linux 10.0
Published Mar 14, 2022
Tracked Since Feb 18, 2026