« Volver al listado

CVE-2022-44011

Estado: ModificadaMedia (6.5)—

An issue was discovered in ClickHouse before 22.9.1.2603. An authenticated user (with the ability to load data) could cause a heap buffer overflow and crash the server by inserting a malformed CapnProto object. The fixed versions are 22.9.1.2603, 22.8.2.11, 22.7.4.16, 22.6.6.16, and 22.3.12.19.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Clickhouse — Clickhouse

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-44011",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-11-23T16:15:07.217",
  "references": [
    {
      "url": "https://clickhouse.com",
      "tags": [
        "Product"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://clickhouse.com",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in ClickHouse before 22.9.1.2603. An authenticated user (with the ability to load data) could cause a heap buffer overflow and crash the server by inserting a malformed CapnProto object. The fixed versions are 22.9.1.2603, 22.8.2.11, 22.7.4.16, 22.6.6.16, and 22.3.12.19."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en ClickHouse antes del 22.9.1.2603. Un usuario autenticado (con la capacidad de cargar datos) podría provocar un desbordamiento del búfer del heap y bloquear el servidor al insertar un objeto CapnProto con formato incorrecto. Las versiones corregidas son 22.9.1.2603, 22.8.2.11, 22.7.4.16, 22.6.6.16 y 22.3.12.19."
    }
  ],
  "lastModified": "2026-06-17T05:07:39.303",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E491243-850E-42B0-93C1-02A5006E76CC",
              "versionEndExcluding": "22.3.12.19"
            },
            {
              "criteria": "cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8AC646C1-A2E2-4E6F-9312-2AF2B3FAED29",
              "versionEndExcluding": "22.6.6.16",
              "versionStartIncluding": "22.6"
            },
            {
              "criteria": "cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2129D28D-F5C8-4824-819B-E27AF634C6BA",
              "versionEndExcluding": "22.7.4.16",
              "versionStartIncluding": "22.7"
            },
            {
              "criteria": "cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B7994FF-D269-4F8A-9388-B60BC23A6EA6",
              "versionEndExcluding": "22.8.2.11",
              "versionStartIncluding": "22.8"
            },
            {
              "criteria": "cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "391AC13C-E2F6-4824-AC29-081AF879666A",
              "versionEndExcluding": "22.9.1.2603",
              "versionStartIncluding": "22.9"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}