CVE-2022-44011: 
NixOS vulnerability analysis and mitigation

An issue was discovered in ClickHouse before version 22.9.1.2603, identified as CVE-2022-44011. The vulnerability allows an authenticated user with data loading privileges to cause a heap buffer overflow and crash the server by inserting a malformed CapnProto object. The vulnerability was discovered and disclosed in October 2022, affecting multiple versions of ClickHouse database software (NVD).

The vulnerability is classified as an Out-of-bounds Write (CWE-787) with a CVSS v3.1 base score of 6.5 (MEDIUM). The attack vector is network-based (AV:N), requires low attack complexity (AC:L), low privileges (PR:L), no user interaction (UI:N), with scope unchanged (S:U), and impacts only availability (A:H) with no effect on confidentiality or integrity (NVD).

The primary impact of this vulnerability is on system availability. When successfully exploited, it can cause the ClickHouse server to crash through a heap buffer overflow, potentially leading to denial of service conditions (NVD).

The vulnerability has been fixed in multiple ClickHouse versions. Users should upgrade to one of the following fixed versions: 22.9.1.2603, 22.8.2.11, 22.7.4.16, 22.6.6.16, or 22.3.12.19 (NVD).