Back to Vulnerability Directory
MEDIUMFixed upstream

CVE-2022-44011

ClickHouse: heap buffer overflow from a malformed CapnProto object

Technology

ClickHouse

CVSS Score

6.5 / 10.0

Affected Versions

ClickHouse before 22.3.12.19, 22.6 before 22.6.6.16, 22.7 before 22.7.4.16, 22.8 before 22.8.2.11, 22.9 before 22.9.1.2603

Upstream Fix

22.3.12.19, 22.6.6.16, 22.7.4.16, 22.8.2.11, 22.9.1.2603

Published

November 23, 2023

OSSeva Coverage

Fixed upstream

Description

An authenticated user who can load data can crash the server by inserting a malformed CapnProto object, which causes a heap buffer overflow.

Upstream record: NVD · CVE.org

Is your ClickHouse deployment affected?

If you're running ClickHouse before 22.3.12.19, 22.6 before 22.6.6.16, 22.7 before 22.7.4.16, 22.8 before 22.8.2.11, 22.9 before 22.9.1.2603, you need this patch. Book a discovery call to get covered.

Book a discovery callView ClickHouse coverage →