Divide-by-zero Vulnerability in ClickHouse's DeltaDouble Compression Codec
CVE-2021-42390

6.5MEDIUM

Key Information:

Vendor

Yandex

Status
Clickhouse
Vendor
CVE Published:
14 March 2022

What is CVE-2021-42390?

A divide-by-zero vulnerability exists in the DeltaDouble compression codec of ClickHouse's DBMS. This issue arises when the first byte of a compressed buffer is used in a modulo operation without proper validation. Malicious users can craft specific queries that, when processed, may trigger this vulnerability, potentially leading to application instability or denial of service. It's crucial for users to review their ClickHouse configurations and apply necessary updates to mitigate this risk.

Affected Version(s)

clickhouse < 21.10.2.15-stable

References

https://jfrog.com/blog/7-rce-and-dos-vulnerabilities-foun...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.