Impact

A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of Gorilla codec that crashes the ClickHouse server process. This attack does not require authentication.

Patches

The issue have been addressed in ClickHouse starting from the following versions: TBA

Workarounds

Affected users are advised to block native port access and temporary switch to HTTP protocol to reduce the exposure before they can upgrade to supported versions.

Backport

If you are maintaining your own forked version of ClickHouse. The fix for this vulnerability can be found in this pull request.