UBUNTU-CVE-2024-6873

It is possible to crash or redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to the ClickHouse server native interface. This redirection is limited to what is available within a 256-byte range of memory at the time o...

CVE-2024-6873 Specially crafted request could caused undefined behaviour which may lead to Remote Code Execution.

It is possible to crash or redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to the ClickHouse server native interface. This redirection is limited to what is available within a 256-byte range of memory at the time o...

CVE-2024-6873

It is possible to crash or redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to the ClickHouse server native interface. This redirection is limited to what is available within a 256-byte range of memory at the time o...

CVE-2024-6873 Specially crafted request could caused undefined behaviour which may lead to Remote Code Execution.

It is possible to crash or redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to the ClickHouse server native interface. This redirection is limited to what is available within a 256-byte range of memory at the time o...

CVE-2024-6873

It is possible to crash or redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to the ClickHouse server native interface. This redirection is limited to what is available within a 256-byte range of memory at the time o...

CVE-2024-6873

CVE-2024-6873 affects ClickHouse server via the native interface. An unauthenticated vector can crash or redirect the server’s execution flow, limited to a 256‑byte memory range, with no known remote code execution (RCE) demonstrated. Fixes have been merged to all currently supported ClickHouse v...

CVE-2024-6873 Specially crafted request could caused undefined behaviour which may lead to Remote Code Execution.

It is possible to crash or redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to the ClickHouse server native interface. This redirection is limited to what is available within a 256-byte range of memory at the time o...

Ubuntu: Security Advisory (USN-6933-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-6873: Heap-based Buffer Overflow

It is possible to crash or redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to the ClickHouse server native interface. This redirection is limited to what is available within a 256-byte range of memory at the time o...

ClickHouse security vulnerabilities

ClickHouse is a ClickHouse open source one of the fastest and most resource efficient open source databases for real-time applications and analytics. A security vulnerability exists in ClickHouse that stems from the ability of an attacker to send a specially crafted request that crashes a server...

Fixed in ClickHouse v24.5, 2024-08-01​

It is possible to redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to the ClickHouse server native interface. This redirection is limited to what is available within a 256-byte range of memory at the time of...

CVE-2024-6873

It is possible to redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to the ClickHouse server native interface. This redirection is limited to what is available within a 256-byte range of memory at the time of...

USN-6933-1: ClickHouse vulnerabilities

It was discovered that ClickHouse incorrectly handled memory, leading to a heap out-of-bounds data read. An attacker could possibly use this issue to cause a denial of service, or leak sensitive information. CVE-2021-42387, CVE-2021-41388 It was discovered that ClickHouse incorrectly handled...

USN-6933-1 clickhouse vulnerabilities

It was discovered that ClickHouse incorrectly handled memory, leading to a heap out-of-bounds data read. An attacker could possibly use this issue to cause a denial of service, or leak sensitive information. CVE-2021-42387, CVE-2021-41388 It was discovered that ClickHouse incorrectly handled...

Ubuntu 20.04 LTS : ClickHouse vulnerabilities (USN-6933-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6933-1 advisory. It was discovered that ClickHouse incorrectly handled memory, leading to a heap out-of-bounds data read. An attacker could possibly use this issue to cau...

com.aoapps:ao-appcluster-all (2.0.1), com.aoapps:ao-appcluster-core (2.0.1) +241 more potentially affected by CVE-2023-50387 via dnsjava:dnsjava (>=3.5.0, <=3.5.3)

dnsjava:dnsjava MAVEN version =3.5.0, =1.3.1, =1.3.1, =1.3.1, =0.3.2-patch6, =6.3.2, =1.1.1, =2.5.9, =2.5.9, =2.1.4, =2.1.4, =2.1.4, =1.0, =1.2 and more Source cves: CVE-2023-50387 Source advisory: GHSA-CRJG-W57M-RQQF...

com.aoapps:ao-appcluster-all (2.0.1), com.aoapps:ao-appcluster-core (2.0.1) +241 more potentially affected by CVE-2023-50868 via dnsjava:dnsjava (>=3.5.0, <=3.5.3)

dnsjava:dnsjava MAVEN version =3.5.0, =1.3.1, =1.3.1, =1.3.1, =0.3.2-patch6, =6.3.2, =1.1.1, =2.5.9, =2.5.9, =2.1.4, =2.1.4, =2.1.4, =1.0, =1.2 and more Source cves: CVE-2023-50868 Source advisory: GHSA-MMWX-RJ87-VFGR...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), dbnd-airflow (0.24.11) +1 more potentially affected by CVE-2024-39863 via apache-airflow (1.10.6)

apache-airflow PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.5.1, =0.5.3 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24.11 Source cves: CVE-2024-39863...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), dbnd-airflow (0.24.11) +1 more potentially affected by CVE-2024-39863 via apache-airflow (1.10.6)

apache-airflow PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.5.1, =0.5.3 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24.11 Source cves: CVE-2024-39863...

airflow-dbt-python (>=0.5.1, <=0.7.2), dbt (0.20.2) +12 more potentially affected by CVE-2024-40637 via dbt-core (0.20.2)

dbt-core PYPI version 0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - airflow-dbt-python =0.5.1, =0.2.0, =0.2.0, =0.20.0rc1, =0.2.0a0, =0.2.0 Source cves: CVE-2024-40637 Source advisory: OSV:PYSEC-2024-66...