CVE-2021-43304

Name of the Vulnerable Software and Affected Versions ClickHouse (affected versions not specified)

Description The issue is related to a heap buffer overflow in ClickHouse's LZ4 compression codec. This occurs when parsing a malicious query, as there is no verification that copy operations do not exceed the destination buffer's limits. Specifically, the arbitrary copy operation in the LZ4::decompressImpl loop can lead to this overflow. An attacker could potentially exploit this vulnerability to execute arbitrary code remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.