Yandex ClickHouse 19.17.4.11

CPE Details

Yandex ClickHouse 19.17.4.11
yandex
clickhouse
19.17.4.11
2020-01-06
18h37 +00:00
2020-01-06
18h37 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:yandex:clickhouse:19.17.4.11:*:*:*:*:*:*:*

Informations

Vendor

yandex

Product

clickhouse

Version

19.17.4.11

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2021-42391 2022-03-14 21h20 +00:00 Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.
6.5
Medium
CVE-2021-42390 2022-03-14 21h20 +00:00 Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.
6.5
Medium
CVE-2021-42389 2022-03-14 21h20 +00:00 Divide-by-zero in Clickhouse's Delta compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.
6.5
Medium
CVE-2021-42387 2022-03-13 23h00 +00:00 Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the upper bounds of the source of the copy operation.
8.1
High
CVE-2021-42388 2022-03-13 23h00 +00:00 Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the lower bounds of the source of the copy operation.
8.1
High
CVE-2021-43304 2022-03-13 23h00 +00:00 Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy(op, ip, copy_end), don’t exceed the destination buffer’s limits.
8.8
High
CVE-2021-43305 2022-03-13 23h00 +00:00 Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy(op, ip, copy_end), don’t exceed the destination buffer’s limits. This issue is very similar to CVE-2021-43304, but the vulnerable copy operation is in a different wildCopy call.
8.8
High