CVE-2021-43305

Name of the Vulnerable Software and Affected Versions ClickHouse (affected versions not specified)

Description The issue is related to a heap buffer overflow in ClickHouse's LZ4 compression codec. This occurs when parsing a malicious query, as there is no verification that copy operations in the LZ4::decompressImpl loop do not exceed the destination buffer's limits. The vulnerable copy operation is in a different wildCopy call, making it similar to a previously identified issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.