574 matches found
PT-2019-9043 · Yandex · Clickhouse
Name of the Vulnerable Software and Affected Versions: ClickHouse versions prior to 18.12.13 Description: The issue allows path traversal and reading of arbitrary files through error messages in functions for loading CatBoost models. Recommendations: For versions prior to 18.12.13, update to...
PT-2019-9041 · Yandex · Clickhouse
Name of the Vulnerable Software and Affected Versions: ClickHouse versions prior to 1.1.54131 Description: The issue is related to an incorrect configuration in the deb package, which could allow unauthorized use of the database. Recommendations: For versions prior to 1.1.54131, update to version...
PT-2019-9040 · Clickhouse · Clickhouse Mysql Client
Name of the Vulnerable Software and Affected Versions: ClickHouse MySQL client versions prior to 1.1.54390 Description: The issue concerns the "LOAD DATA LOCAL INFILE" functionality in the ClickHouse MySQL client, which was enabled and allowed a malicious MySQL database to read arbitrary files fr...
Fixed in ClickHouse Release 18.12.13, 2018-09-10
Functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages...
Fixed in ClickHouse Release 18.12.13, 2018-09-10
Functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages...
Fixed in ClickHouse Release 18.10.3, 2018-08-13
unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability...
Fixed in ClickHouse Release 18.10.3, 2018-08-13
unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability...
Fixed in ClickHouse Release 1.1.54390, 2018-07-06
ClickHouse MySQL client had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server...
CVE-2018-14669
ClickHouse MySQL client had “LOAD DATA LOCAL INFILE” functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server. Andrey Krasichkov and Evgeny Sidorov of Yandex Information Security Team...
Fixed in ClickHouse Release 1.1.54390, 2018-07-06
ClickHouse MySQL client had “LOAD DATA LOCAL INFILE” functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server...
Fixed in ClickHouse Release 1.1.54388, 2018-06-28
"remote" table function allowed arbitrary symbols in "user", "password" and "defaultdatabase" fields which led to Cross Protocol Request Forgery Attacks...
Fixed in ClickHouse Release 1.1.54388, 2018-06-28
“remote” table function allowed arbitrary symbols in “user”, “password” and “defaultdatabase” fields which led to Cross Protocol Request Forgery Attacks...