{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-06T14:05:50.678","vulnerabilities":[{"cve":{"id":"CVE-2021-42388","sourceIdentifier":"reefs@jfrog.com","published":"2022-03-14T23:15:07.970","lastModified":"2025-06-25T20:49:29.357","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the lower bounds of the source of the copy operation."},{"lang":"es","value":"Una lectura fuera de límites de la pila en el códec de compresión LZ4 de Clickhouse cuando es analizada una consulta maliciosa. Como parte del bucle LZ4::decompressImpl(), es leído un valor de 16 bits sin signo proporcionado por el usuario (\"offset\") de los datos comprimidos. El offset es usado posteriormente en la longitud de una operación de copia, sin comprobar los límites inferiores del origen de la operación de copia"}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:P","baseScore":5.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"reefs@jfrog.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*","versionEndExcluding":"21.10.2.15","matchCriteriaId":"4CD6B56E-9355-4A1F-9FF8-4FA097CF8AB4"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}]}]}],"references":[{"url":"https://jfrog.com/blog/7-rce-and-dos-vulnerabilities-found-in-clickhouse-dbms","source":"reefs@jfrog.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/11/msg00002.html","source":"reefs@jfrog.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://jfrog.com/blog/7-rce-and-dos-vulnerabilities-found-in-clickhouse-dbms","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/11/msg00002.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}}]}