CVE-2021-43304: 
NixOS vulnerability analysis and mitigation

A heap buffer overflow vulnerability (CVE-2021-43304) was discovered in ClickHouse's LZ4 compression codec when parsing malicious queries. The vulnerability was discovered in March 2022 and affects ClickHouse versions prior to v21.10.2.15-stable. The vulnerability requires authentication but can be triggered by any user with read permissions, even those with the lowest privileges (JFrog Blog, Hacker News).

The vulnerability exists in the LZ4 compression codec's decompression implementation. When processing compressed queries, there is no verification that copy operations in the LZ4::decompressImpl loop, particularly the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don't exceed the destination buffer's limits. The vulnerability has a CVSSv3.1 score of 8.8, indicating high severity (JFrog Blog).

By exploiting this vulnerability, an attacker can potentially achieve remote code execution (RCE) on affected ClickHouse servers. The vulnerability allows for heap buffer overflow, which can lead to arbitrary code execution through controlled memory corruption (JFrog Blog, Hacker News).

Users are recommended to update ClickHouse to version v21.10.2.15-stable or later. If upgrading is not immediately possible, administrators can implement firewall rules to restrict access to the web port (8123) and TCP server's port (9000) to specific clients only (JFrog Blog).