CVE-2021-42391 — Divide By Zero in Clickhouse

CWE-369 — Divide By Zero3 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.6%
top 31.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Yandex ClickhouseClickhouseDebian Clickhouse
Timeline
PublishedMar 14
Latest updateMar 16

Description

Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5yandex/clickhouseunspecified — 21.10.2.15-stable
▶NVDclickhouse/clickhouse< 21.10.2.15

🔴Vulnerability Details

1
GHSA
GHSA-rfqp-qc69-jhvm: Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query↗2022-03-16
▶

📋Vendor Advisories

1
Debian
CVE-2021-42391: clickhouse - Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a maliciou...↗2021
▶