Debian Package Tracker
Register | Log in
Subscribe

clickhouse

Choose email to subscribe with

general
  • source: clickhouse (main)
  • version: 18.16.1+ds-7.2
  • maintainer: Alexander GQ Gerasiov (DMD)
  • arch: arm64 hppa ia64 mips64el ppc64 ppc64el s390x sparc64
  • std-ver: 4.3.0
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • oldstable: 18.16.1+ds-4
  • stable: 18.16.1+ds-7.2
  • unstable: 18.16.1+ds-7.2
versioned links
  • 18.16.1+ds-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 18.16.1+ds-7.2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • clickhouse-client
  • clickhouse-common
  • clickhouse-server (1 bugs: 0, 1, 0, 0)
  • clickhouse-tools
action needed
4 binary packages have unsatisfiable dependencies high
  • The dependencies of clickhouse-common=18.16.1+ds-7.2+b1 cannot be satisfied in unstable on amd64 and ppc64el because: unsatisfied dependency on libcapnp-0.7.0
  • The dependencies of clickhouse-tools=18.16.1+ds-7.2+b1 cannot be satisfied in unstable on amd64 and ppc64el because: unsatisfied dependency on libcapnp-0.7.0
  • The dependencies of clickhouse-server=18.16.1+ds-7.2+b1 cannot be satisfied in unstable on amd64 and ppc64el because: unsatisfied dependency on libcapnp-0.7.0
  • The dependencies of clickhouse-client=18.16.1+ds-7.2+b1 cannot be satisfied in unstable on amd64 and ppc64el because: unsatisfied dependency on libpocofoundation70 (>= 1.10.0)
Created: 2021-12-22 Last update: 2022-05-20 22:08
A new upstream version is available: 22.4.5.9 high
A new upstream version 22.4.5.9 is available, you should consider packaging it.
Created: 2021-09-05 Last update: 2022-05-20 19:37
4 security issues in sid high

There are 4 open security issues in sid.

4 important issues:
  • CVE-2021-42387: Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the upper bounds of the source of the copy operation.
  • CVE-2021-42388: Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the lower bounds of the source of the copy operation.
  • CVE-2021-43304: Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don’t exceed the destination buffer’s limits.
  • CVE-2021-43305: Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don’t exceed the destination buffer’s limits. This issue is very similar to CVE-2021-43304, but the vulnerable copy operation is in a different wildCopy call.
Created: 2022-03-24 Last update: 2022-03-24 15:04
4 security issues in buster high

There are 4 open security issues in buster.

4 important issues:
  • CVE-2021-42387: Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the upper bounds of the source of the copy operation.
  • CVE-2021-42388: Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the lower bounds of the source of the copy operation.
  • CVE-2021-43304: Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don’t exceed the destination buffer’s limits.
  • CVE-2021-43305: Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don’t exceed the destination buffer’s limits. This issue is very similar to CVE-2021-43304, but the vulnerable copy operation is in a different wildCopy call.
Created: 2022-03-24 Last update: 2022-03-24 15:04
4 security issues in bullseye high

There are 4 open security issues in bullseye.

4 important issues:
  • CVE-2021-42387: Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the upper bounds of the source of the copy operation.
  • CVE-2021-42388: Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the lower bounds of the source of the copy operation.
  • CVE-2021-43304: Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don’t exceed the destination buffer’s limits.
  • CVE-2021-43305: Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don’t exceed the destination buffer’s limits. This issue is very similar to CVE-2021-43304, but the vulnerable copy operation is in a different wildCopy call.
Created: 2022-03-24 Last update: 2022-03-24 15:04
lintian reports 10 warnings high
Lintian reports 10 warnings about this package. You should make the package lintian clean getting rid of them.
Created: 2021-01-27 Last update: 2021-10-13 21:31
The package has not entered testing even though the delay is over normal
The package has not entered testing even though the 5-day delay is over. Check why.
Created: 2021-10-17 Last update: 2022-05-20 21:04
2 new commits since last upload, is it time to release? normal
vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:
commit cdafd3f02442ddda616177f9142f1c3e7efe97fd
Author: Balint Reczey <balint.reczey@canonical.com>
Date:   Thu Dec 3 22:07:57 2020 +0100

    Update changelog

commit 9ccb2ca661ec15c06a627519aa16cbf11db6d796
Author: Balint Reczey <balint.reczey@canonical.com>
Date:   Thu Dec 3 20:45:44 2020 +0100

    Fix multiple FTBFS problems
Created: 2020-12-03 Last update: 2022-05-12 19:35
Standards version of the package is outdated. wishlist
The package should be updated to follow the last version of Debian Policy (Standards-Version 4.6.1 instead of 4.3.0).
Created: 2019-07-08 Last update: 2022-05-11 23:25
testing migrations
  • This package is part of the ongoing testing transition known as auto-openssl. Please avoid uploads unrelated to this transition, they would likely delay it and require supplementary work from the release managers. On the other hand, if your package has problems preventing it to migrate to testing, please fix them as soon as possible. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
  • excuses:
    • Migration status for clickhouse (- to 18.16.1+ds-7.2): BLOCKED: Rejected/violates migration policy/introduces a regression
    • Issues preventing migration:
    • ∙ ∙ clickhouse-client/amd64 has unsatisfiable dependency
    • ∙ ∙ clickhouse-common/amd64 has unsatisfiable dependency
    • ∙ ∙ clickhouse-server/amd64 has unsatisfiable dependency
    • ∙ ∙ clickhouse-tools/amd64 has unsatisfiable dependency
    • ∙ ∙ clickhouse-client/ppc64el has unsatisfiable dependency
    • ∙ ∙ clickhouse-common/ppc64el has unsatisfiable dependency
    • ∙ ∙ clickhouse-server/ppc64el has unsatisfiable dependency
    • ∙ ∙ clickhouse-tools/ppc64el has unsatisfiable dependency
    • ∙ ∙ Updating clickhouse would introduce bugs in testing: #995660, #996130
    • Additional info:
    • ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/c/clickhouse.html
    • ∙ ∙ uninstallable on arch amd64, not running autopkgtest there
    • ∙ ∙ uninstallable on arch ppc64el, not running autopkgtest there
    • ∙ ∙ 533 days old (needed 5 days)
    • Not considered
news
[rss feed]
  • [2021-10-18] clickhouse REMOVED from testing (Debian testing watch)
  • [2020-12-09] clickhouse 18.16.1+ds-7.2 MIGRATED to testing (Debian testing watch)
  • [2020-12-09] clickhouse 18.16.1+ds-7.2 MIGRATED to testing (Debian testing watch)
  • [2020-12-03] Accepted clickhouse 18.16.1+ds-7.2 (source) into unstable (Balint Reczey)
  • [2020-08-28] clickhouse REMOVED from testing (Debian testing watch)
  • [2020-07-12] clickhouse 18.16.1+ds-7.1 MIGRATED to testing (Debian testing watch)
  • [2020-07-01] Accepted clickhouse 18.16.1+ds-7.1 (source) into unstable (Adrian Bunk)
  • [2020-04-04] clickhouse 18.16.1+ds-7 MIGRATED to testing (Debian testing watch)
  • [2020-03-30] Accepted clickhouse 18.16.1+ds-7 (source) into unstable (Sandro Tosi)
  • [2020-03-26] Accepted clickhouse 18.16.1+ds-6 (source) into unstable (Sandro Tosi)
  • [2019-08-27] clickhouse 18.16.1+ds-5 MIGRATED to testing (Debian testing watch)
  • [2019-08-21] Accepted clickhouse 18.16.1+ds-5 (source) into unstable (Alexander GQ Gerasiov)
  • [2019-02-09] clickhouse 18.16.1+ds-4 MIGRATED to testing (Debian testing watch)
  • [2019-02-03] Accepted clickhouse 18.16.1+ds-4 (source) into unstable (Alexander GQ Gerasiov)
  • [2019-01-31] Accepted clickhouse 18.16.1+ds-3 (source) into unstable (Alexander GQ Gerasiov)
  • [2019-01-31] Accepted clickhouse 18.16.1+ds-2 (source) into unstable (Alexander GQ Gerasiov)
  • [2019-01-29] clickhouse 18.16.1+ds-1 MIGRATED to testing (Debian testing watch)
  • [2019-01-23] Accepted clickhouse 18.16.1+ds-1 (source amd64) into unstable, unstable (Alexander GQ Gerasiov)
bugs [bug history graph]
  • all: 5
  • RC: 2
  • I&N: 3
  • M&W: 0
  • F&P: 0
  • patch: 0
links
  • homepage
  • lintian (0, 10)
  • buildd: logs, clang, debcheck, cross
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker

Debian Package Tracker — Copyright 2013-2018 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing