Heap Buffer Overflow in Clickhouse's LZ4 Compression Codec

CVE-2021-43305

What is CVE-2021-43305?

A vulnerability exists in Clickhouse's LZ4 compression codec that may allow an attacker to exploit a heap buffer overflow when processing maliciously crafted queries. Due to the absence of checks on the size of data being copied in the decompress operation, it could lead to potential data corruption or unexpected behavior, similar to other known vulnerabilities in the same family. Organizations using Clickhouse should ensure they implement the necessary security updates to protect against this exploit.

References