UBUNTU-CVE-2021-43305
- Source
- https://ubuntu.com/security/CVE-2021-43305
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-43305.json
- JSON Data
- https://api.osv.dev/v1/vulns/UBUNTU-CVE-2021-43305
- Upstream
- Downstream
- Related
- Published
- 2022-03-14T23:15:00Z
- Modified
- 2025-09-08T16:47:24Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Ubuntu - medium
- Summary
- [none]
- Details
-
Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don’t exceed the destination buffer’s limits. This issue is very similar to CVE-2021-43304, but the vulnerable copy operation is in a different wildCopy call.
- References
-
- https://ubuntu.com/security/CVE-2021-43305
- https://github.com/ClickHouse/ClickHouse/commit/2aea1c8d4a5be320365472052d8a48bf69fd9fe9
- https://github.com/ClickHouse/ClickHouse/commit/6d83eacec42c7c403c99804a713a9d38caa4a45d
- https://github.com/ClickHouse/ClickHouse/pull/27136
- https://jfrog.com/blog/7-rce-and-dos-vulnerabilities-found-in-clickhouse-dbms/
- https://www.cve.org/CVERecord?id=CVE-2021-43305
- https://ubuntu.com/security/notices/USN-6933-1
Affected packages
Ubuntu:20.04:LTS / clickhouse
Package
- Name
- clickhouse
- Purl
- pkg:deb/ubuntu/clickhouse@18.16.1+ds-7ubuntu0.1?arch=source&distro=focal
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed18.16.1+ds-7ubuntu0.1
Affected versions
18.*
18.16.1+ds-5
18.16.1+ds-5ubuntu1
18.16.1+ds-5ubuntu2
18.16.1+ds-6ubuntu1
18.16.1+ds-7
Ecosystem specific
{
"binaries": [
{
"binary_version": "18.16.1+ds-7ubuntu0.1",
"binary_name": "clickhouse-client"
},
{
"binary_version": "18.16.1+ds-7ubuntu0.1",
"binary_name": "clickhouse-common"
},
{
"binary_version": "18.16.1+ds-7ubuntu0.1",
"binary_name": "clickhouse-server"
},
{
"binary_version": "18.16.1+ds-7ubuntu0.1",
"binary_name": "clickhouse-tools"
}
],
"availability": "No subscription required"
}