CVE-2021-42387
Published: 14 March 2022
Summary
CVE-2021-42387 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Clickhouse Clickhouse. Its CVSS base score is 8.1 (High).
Operationally, ranked at the 47.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-29358
Vulnerability details
Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of…
more
a copy operation, without checking the upper bounds of the source of the copy operation.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.