CVE-2021-42388CWE-125

CVE-2021-42388: vulnerability in yandex clickhouse

Published · Updated

Follow this CVE+ Monitor clickhouse+ Monitor clickhouse

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 1.6%
Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the lower bounds of the source of the copy operation.
Affected products
yandex · clickhouse
Related CVEs — yandex clickhouse

In the same product, most dangerous first.

CVE-2021-43304—CVE-2021-43304EPSS 1.7%CVE-2021-43305—CVE-2021-43305EPSS 1.7%CVE-2021-42387—CVE-2021-42387EPSS 1.6%CVE-2021-42391—CVE-2021-42391EPSS 1.4%CVE-2021-42390—CVE-2021-42390EPSS 1.3%CVE-2021-42389—CVE-2021-42389EPSS 1.3%