CVE-2021-42387

Heap out-of-bounds read in ClickHouse’s LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl loop, a 16-bit unsigned user-supplied value ‘offset’ is read from the compressed data. The offset is later used in the length of a copy operation, without checking the...

CVE-2021-42391

Divide-by-zero in ClickHouse’s Gorilla compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0. JFrog Security Research Team...

clickhouse:execute_query_fuzzer: Stack-use-after-return in execute_query_fuzzer

Project: https://github.com/ClickHouse/ClickHouse.git Detailed Report: https://oss-fuzz.com/testcase?key=6421783532666880 Project: clickhouse Fuzzing Engine: libFuzzer Fuzz Target: executequeryfuzzer Job Type: libfuzzerasanclickhouse Platform Id: linux Crash Type: Stack-use-after-return READ 4...

aglow (>=0.1.0rc3, <=0.1.0rc4), ai-flow (0.3.1) +7 more potentially affected by CVE-2021-38540 via apache-airflow (>=2.0.0, <=2.1.2)

apache-airflow PYPI version =2.0.0, =0.1.0rc3, =0.0.4rc1, =0.0.0, =0.3.12, =11.8.0, =14.7.0 - gps-building-blocks 1.2.2 - viewflow 0.1.0 Source cves: CVE-2021-38540 Source advisory: MEND:CVE-2021-38540...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), airflow-docker (>=1.0.0, <=1.1.0) +5 more potentially affected by CVE-2021-32805 via flask-appbuilder (1.13.1)

flask-appbuilder PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - airflow-clickhouse-plugin =0.5.1, =1.0.0, =1.10.0, =1.10.4b2, =1.10.6 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24....

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), airflow-docker (>=1.0.0, <=1.1.0) +5 more potentially affected by CVE-2021-32805 via flask-appbuilder (1.13.1)

flask-appbuilder PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - airflow-clickhouse-plugin =0.5.1, =1.0.0, =1.10.0, =1.10.4b2, =1.10.6 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24....

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), dbnd-airflow (0.24.11) +1 more potentially affected by CVE-2021-35936 via apache-airflow (1.10.6)

apache-airflow PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.5.1, =0.5.3 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24.11 Source cves: CVE-2021-35936...

clickhouse:compressed_buffer_fuzzer: Heap-buffer-overflow in DB::CompressionCodecNone::doDecompressData

Project: https://github.com/ClickHouse/ClickHouse.git Detailed Report: https://oss-fuzz.com/testcase?key=5433699089383424 Project: clickhouse Fuzzing Engine: libFuzzer Fuzz Target: compressedbufferfuzzer Job Type: libfuzzerasanclickhouse Platform Id: linux Crash Type: Heap-buffer-overflow READ...

DNSMonster - Passive DNS Capture/Monitoring Framework

Passive DNS collection and monitoring built with Golang, Clickhouse and Grafana: dnsmonster implements a packet sniffer for DNS traffic. It can accept traffic from a pcap file, a live interface or a dnstap socket, and can be used to index and store thousands of DNS queries per second it has shown...

CVE-2021-25263

Removed by vendor...

Yandex Browser security vulnerabilities

Yandex ClickHouse is a set of open source columnar databases for online analytical processing from the Russian company Yandex. A security vulnerability exists in previous versions of Yandex Clickhouse v20.8.18.32-lts, v21.1.9.41-stable, v21.2.9.41-stable, v21.3.6.55-lts, and v21.4.3.21-stable,...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), dbnd-airflow (0.24.11) +1 more potentially affected by CVE-2021-35936 via apache-airflow (1.10.6)

apache-airflow PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.5.1, =0.5.3 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24.11 Source cves: CVE-2021-35936...

Adminer < 4.7.8 Server-Side Request Forgery

The version of Adminer installed on the remote host suffers from a Server-Side Request Forgery SSRF flaw via the error page of Elasticsearch and ClickHouse in versions bundling all drivers, this may permit clients to make onward connections to arbitrary systems/ports & can be used to potentially...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), airflow-docker (>=1.0.0, <=1.1.0) +5 more potentially affected by CVE-2021-29621 via flask-appbuilder (1.13.1)

flask-appbuilder PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - airflow-clickhouse-plugin =0.5.1, =1.0.0, =1.10.0, =1.10.4b2, =1.10.6 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24....

GitHub Security Lab: Python: Add support of clickhouse-driver package

This bug was reported directly to GitHub Security Lab...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), airflow-docker (>=1.0.0, <=1.1.0) +5 more potentially affected by CVE-2021-29621 via flask-appbuilder (1.13.1)

flask-appbuilder PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - airflow-clickhouse-plugin =0.5.1, =1.0.0, =1.10.0, =1.10.4b2, =1.10.6 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24....

PT-2021-6811 · Yandex +1 · Yandex Browser +1

Name of the Vulnerable Software and Affected Versions: ClickHouse versions prior to v20.8.18.32-lts ClickHouse versions prior to v21.1.9.41-stable ClickHouse versions prior to v21.2.9.41-stable ClickHouse versions prior to v21.3.6.55-lts ClickHouse versions prior to v21.4.3.21-stable Yandex Brows...

Fixed in ClickHouse 21.4.3.21, 2021-04-12 

An attacker that has CREATE DICTIONARY privilege, can read arbitary file outside permitted directory...

Fixed in ClickHouse 21.4.3.21, 2021-04-12​

An attacker that has CREATE DICTIONARY privilege, can read arbitary file outside permitted directory...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), baluchon (0.0.1) +4 more potentially affected by CVE-2020-26759 via clickhouse-driver (>=0.1.1, <=0.1.4)

clickhouse-driver PYPI version =0.1.1, =0.5.1, =0.0.4, =2.2.0, =2.3.2 Source cves: CVE-2020-26759 Source advisory: OSV:GHSA-VGV5-CXVH-VFXH...