clickhouse - Debian Package Tracker

general

source: clickhouse (main)
version: 18.16.1+ds-7.2
maintainer: Alexander GQ Gerasiov (DMD)
arch: arm64 hppa ia64 mips64el ppc64 ppc64el s390x sparc64
std-ver: 4.3.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 18.16.1+ds-4
stable: 18.16.1+ds-7.2
unstable: 18.16.1+ds-7.2

versioned links

18.16.1+ds-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
18.16.1+ds-7.2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

clickhouse-client
clickhouse-common
clickhouse-server (1 bugs: 0, 1, 0, 0)
clickhouse-tools

action needed

4 binary packages have unsatisfiable dependencies high

The dependencies of clickhouse-common=18.16.1+ds-7.2+b1 cannot be satisfied in unstable on amd64 and ppc64el because: unsatisfied dependency on libcapnp-0.7.0
The dependencies of clickhouse-tools=18.16.1+ds-7.2+b1 cannot be satisfied in unstable on amd64 and ppc64el because: unsatisfied dependency on libcapnp-0.7.0
The dependencies of clickhouse-server=18.16.1+ds-7.2+b1 cannot be satisfied in unstable on amd64 and ppc64el because: unsatisfied dependency on libcapnp-0.7.0
The dependencies of clickhouse-client=18.16.1+ds-7.2+b1 cannot be satisfied in unstable on amd64 and ppc64el because: unsatisfied dependency on libpocofoundation70 (>= 1.10.0)

Created: 2021-12-22 Last update: 2022-05-20 22:08

A new upstream version is available: 22.4.5.9 high

A new upstream version 22.4.5.9 is available, you should consider packaging it.

Created: 2021-09-05 Last update: 2022-05-20 19:37

4 security issues in sid high

There are 4 open security issues in sid.

4 important issues:

CVE-2021-42387: Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the upper bounds of the source of the copy operation.
CVE-2021-42388: Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the lower bounds of the source of the copy operation.
CVE-2021-43304: Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don’t exceed the destination buffer’s limits.
CVE-2021-43305: Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don’t exceed the destination buffer’s limits. This issue is very similar to CVE-2021-43304, but the vulnerable copy operation is in a different wildCopy call.

Created: 2022-03-24 Last update: 2022-03-24 15:04

4 security issues in buster high

There are 4 open security issues in buster.

4 important issues:

CVE-2021-42387: Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the upper bounds of the source of the copy operation.
CVE-2021-42388: Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the lower bounds of the source of the copy operation.
CVE-2021-43304: Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don’t exceed the destination buffer’s limits.
CVE-2021-43305: Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don’t exceed the destination buffer’s limits. This issue is very similar to CVE-2021-43304, but the vulnerable copy operation is in a different wildCopy call.

Created: 2022-03-24 Last update: 2022-03-24 15:04

4 security issues in bullseye high

There are 4 open security issues in bullseye.

4 important issues:

CVE-2021-42387: Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the upper bounds of the source of the copy operation.
CVE-2021-42388: Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the lower bounds of the source of the copy operation.
CVE-2021-43304: Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don’t exceed the destination buffer’s limits.
CVE-2021-43305: Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don’t exceed the destination buffer’s limits. This issue is very similar to CVE-2021-43304, but the vulnerable copy operation is in a different wildCopy call.

Created: 2022-03-24 Last update: 2022-03-24 15:04

lintian reports 10 warnings high

Lintian reports 10 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2021-01-27 Last update: 2021-10-13 21:31

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 5-day delay is over. Check why.

Created: 2021-10-17 Last update: 2022-05-20 21:04

2 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit cdafd3f02442ddda616177f9142f1c3e7efe97fd
Author: Balint Reczey <balint.reczey@canonical.com>
Date:   Thu Dec 3 22:07:57 2020 +0100

    Update changelog

commit 9ccb2ca661ec15c06a627519aa16cbf11db6d796
Author: Balint Reczey <balint.reczey@canonical.com>
Date:   Thu Dec 3 20:45:44 2020 +0100

    Fix multiple FTBFS problems

Created: 2020-12-03 Last update: 2022-05-12 19:35

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.6.1 instead of 4.3.0).

Created: 2019-07-08 Last update: 2022-05-11 23:25

testing migrations

This package is part of the ongoing testing transition known as auto-openssl. Please avoid uploads unrelated to this transition, they would likely delay it and require supplementary work from the release managers. On the other hand, if your package has problems preventing it to migrate to testing, please fix them as soon as possible. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
excuses:
- Migration status for clickhouse (- to 18.16.1+ds-7.2): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ clickhouse-client/amd64 has unsatisfiable dependency
- ∙ ∙ clickhouse-common/amd64 has unsatisfiable dependency
- ∙ ∙ clickhouse-server/amd64 has unsatisfiable dependency
- ∙ ∙ clickhouse-tools/amd64 has unsatisfiable dependency
- ∙ ∙ clickhouse-client/ppc64el has unsatisfiable dependency
- ∙ ∙ clickhouse-common/ppc64el has unsatisfiable dependency
- ∙ ∙ clickhouse-server/ppc64el has unsatisfiable dependency
- ∙ ∙ clickhouse-tools/ppc64el has unsatisfiable dependency
- ∙ ∙ Updating clickhouse would introduce bugs in testing: #995660, #996130
- Additional info:
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/c/clickhouse.html
- ∙ ∙ uninstallable on arch amd64, not running autopkgtest there
- ∙ ∙ uninstallable on arch ppc64el, not running autopkgtest there
- ∙ ∙ 533 days old (needed 5 days)
- Not considered

news

[rss feed]

[2021-10-18] clickhouse REMOVED from testing (Debian testing watch)
[2020-12-09] clickhouse 18.16.1+ds-7.2 MIGRATED to testing (Debian testing watch)
[2020-12-09] clickhouse 18.16.1+ds-7.2 MIGRATED to testing (Debian testing watch)
[2020-12-03] Accepted clickhouse 18.16.1+ds-7.2 (source) into unstable (Balint Reczey)
[2020-08-28] clickhouse REMOVED from testing (Debian testing watch)
[2020-07-12] clickhouse 18.16.1+ds-7.1 MIGRATED to testing (Debian testing watch)
[2020-07-01] Accepted clickhouse 18.16.1+ds-7.1 (source) into unstable (Adrian Bunk)
[2020-04-04] clickhouse 18.16.1+ds-7 MIGRATED to testing (Debian testing watch)
[2020-03-30] Accepted clickhouse 18.16.1+ds-7 (source) into unstable (Sandro Tosi)
[2020-03-26] Accepted clickhouse 18.16.1+ds-6 (source) into unstable (Sandro Tosi)
[2019-08-27] clickhouse 18.16.1+ds-5 MIGRATED to testing (Debian testing watch)
[2019-08-21] Accepted clickhouse 18.16.1+ds-5 (source) into unstable (Alexander GQ Gerasiov)
[2019-02-09] clickhouse 18.16.1+ds-4 MIGRATED to testing (Debian testing watch)
[2019-02-03] Accepted clickhouse 18.16.1+ds-4 (source) into unstable (Alexander GQ Gerasiov)
[2019-01-31] Accepted clickhouse 18.16.1+ds-3 (source) into unstable (Alexander GQ Gerasiov)
[2019-01-31] Accepted clickhouse 18.16.1+ds-2 (source) into unstable (Alexander GQ Gerasiov)
[2019-01-29] clickhouse 18.16.1+ds-1 MIGRATED to testing (Debian testing watch)
[2019-01-23] Accepted clickhouse 18.16.1+ds-1 (source amd64) into unstable, unstable (Alexander GQ Gerasiov)

bugs [bug history graph]

all: 5
RC: 2
I&N: 3
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (0, 10)
buildd: logs, clang, debcheck, cross
popcon
browse source code
edit tags
other distros
security tracker