PT-2022-27073 · Unknown+2 · Clickhouse+1

Kiojj · Published 2022-09-22 · Updated 2023-11-30 · CVE-2022-44010

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ClickHouse versions prior to 22.9.1.2603 ClickHouse versions prior to 22.8.2.11 ClickHouse versions prior to 22.7.4.16 ClickHouse versions prior to 22.6.6.16 ClickHouse versions prior to 22.3.12.19

Description A heap-based buffer overflow issue was discovered in the ClickHouse server, allowing an attacker to send a crafted HTTP request to the HTTP Endpoint, usually listening on port 8123 by default, causing the process to crash. This issue does not require authentication.

Recommendations For versions prior to 22.9.1.2603, update to version 22.9.1.2603 or later. For versions prior to 22.8.2.11, update to version 22.8.2.11 or later. For versions prior to 22.7.4.16, update to version 22.7.4.16 or later. For versions prior to 22.6.6.16, update to version 22.6.6.16 or later. For versions prior to 22.3.12.19, update to version 22.3.12.19 or later.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2022-44010

ECHO-CF7F-65C8-584D

Affected Products

Clickhouse

Debian

References · 9

• https://clickhouse.com/docs/en/whats-new/security-changelog · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-44010 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-44010 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-44010 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-44010 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-44010 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-44010 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-44010 · Vendor Advisory
• https://github.com/ClickHouse/ClickHouse/pull/40292 · Note