ID |
CVE-2021-42387
|
Sažetak |
Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the upper bounds of the source of the copy operation. |
Reference |
|
CVSS |
Base: | 5.5 |
Impact: | 4.9 |
Exploitability: | 8.0 |
|
Pristup |
Vektor | Složenost | Autentikacija |
NETWORK |
LOW |
SINGLE |
|
Impact |
Povjerljivost | Cjelovitost | Dostupnost |
PARTIAL |
NONE |
PARTIAL |
|
CVSS vektor |
AV:N/AC:L/Au:S/C:P/I:N/A:P |
Zadnje važnije ažuriranje |
03-12-2022 - 02:47 |
Objavljeno |
14-03-2022 - 23:15 |