Lucene search

GoogleOSV:USN-6933-1

HistoryJul 31, 2024 - 8:17 a.m.

clickhouse vulnerabilities

2024-07-3108:17:56

Google

osv.dev

clickhouse

memory handling

vulnerabilities

denial of service

sensitive information

heap out-of-bounds

data read

heap-based buffer overflow

execute arbitrary code

cve-2021-42387

cve-2021-41388

cve-2021-43304

cve-2021-43305

software

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

JSON

It was discovered that ClickHouse incorrectly handled memory, leading to a
heap out-of-bounds data read. An attacker could possibly use this issue to
cause a denial of service, or leak sensitive information.
(CVE-2021-42387, CVE-2021-41388)

It was discovered that ClickHouse incorrectly handled memory, leading to a
heap-based buffer overflow. An attacker could possibly use this issue to
cause a denial of service, or execute arbitrary code. (CVE-2021-43305)