wolfi/trino-plugin-clickhouse

Vulnerabilities (71)

• CVE-2022-39135Sep 11, 2022
  affected < 453-r2fixed 453-r2

  Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefore any client exposin

• CVE-2022-36364Jul 28, 2022
  affected < 453-r2fixed 453-r2

  Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via `httpclient_impl` connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution l

• CVE-2022-25647May 1, 2022
  affected < 439-r0fixed 439-r0

  The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

• CVE-2021-22569Jan 7, 2022
  affected < 439-r0fixed 439-r0

  An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause fre

• CVE-2020-13949Feb 12, 2021
  affected < 440-r0fixed 440-r0

  In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.

• CVE-2020-8908Dec 10, 2020
  affected < 439-r0fixed 439-r0

  A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the

• CVE-2020-13956Dec 2, 2020
  affected < 440-r0fixed 440-r0

  Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

• CVE-2019-0205Oct 28, 2019
  affected < 440-r0fixed 440-r0

  In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language

• CVE-2019-10086Aug 20, 2019
  affected < 439-r0fixed 439-r0

  In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the Prop

• CVE-2018-11798Jan 7, 2019
  affected < 440-r0fixed 440-r0

  The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.

• CVE-2012-5783Nov 4, 2012
  affected < 445-r0fixed 445-r0

  Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows m