CVE-2022-44010

· HIGHModified

← All CVEs

CVSS v3.1

7.5

EPSS

0.97%

Published

Nov 23, 2023

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An issue was discovered in ClickHouse before 22.9.1.2603. An attacker could send a crafted HTTP request to the HTTP Endpoint (usually listening on port 8123 by default), causing a heap-based buffer overflow that crashes the process. This does not require authentication. The fixed versions are 22.9.1.2603, 22.8.2.11, 22.7.4.16, 22.6.6.16, and 22.3.12.19.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-787

Affected Products (5)

clickhouse · clickhouse (up to 22.3.12.19)vulnerable

clickhouse · clickhouse (up to 22.6.6.16)vulnerable

clickhouse · clickhouse (up to 22.7.4.16)vulnerable

clickhouse · clickhouse (up to 22.8.2.11)vulnerable

clickhouse · clickhouse (up to 22.9.1.2603)vulnerable

References (2)

https://clickhouse.com/docs/en/whats-new/security-changelog

Vendor Advisory

https://clickhouse.com/docs/en/whats-new/security-changelog

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs