Detections
Analytics
ClickHouse < 21.10.2.15 Multiple Vulnerabilities
high Nessus Plugin ID 216691
Synopsis
The remote host is affected by a vulnerability.Description
The version of ClickHouse installed on the remote host is prior to 21.10.2.15. It is, therefore, affected by multiple vulnerabilities.- Heap out-of-bounds read vulnerability in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data.
The offset is later used in the length of a copy operation, without checking the upper bounds of the source of the copy operation. (CVE-2021-42387, CVE-2021-42388)
- Divide-by-zero in multiple Clickhouse's compression codecs when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0. (CVE-2021-42389, CVE-2021-42390, CVE-2021-42391)
- Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don’t exceed the destination buffer’s limits. (CVE-2021-43304, CVE-2021-43305)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Upgrade to ClickHouse version 21.10.2.15 or later.See Also
https://lists.debian.org/debian-lts-announce/2022/11/msg00002.html
Plugin Details
Severity: High
ID: 216691
File Name: clickhouse_CVE-2021-42387.nasl
Version: 1.2
Type: remote
Family: Misc.
Published: 2/24/2025
Updated: 2/25/2025
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.2
Temporal Score: 5.6
Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2021-42304
CVSS v3
Risk Factor: High
Base Score: 8.1
Temporal Score: 7.3
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS Score Source: CVE-2021-42388
Vulnerability Information
CPE: cpe:/a:yandex:clickhouse
Required KB Items: installed_sw/ClickHouse
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 3/14/2022
Vulnerability Publication Date: 3/14/2022
Reference Information
CVE: CVE-2021-42304, CVE-2021-42305, CVE-2021-42387, CVE-2021-42388, CVE-2021-42389, CVE-2021-42390, CVE-2021-42391