CVE-2024-22412

The CVE-2024-22412 issue affects ClickHouse: in cloud ClickHouse prior to 24.0.2.54535 and in ClickHouse 23.1, query caching can bypass role-based access controls, exposing data to users with a role who should be restricted. Affected versions' query cache behavior is described as not documented a...

CVE-2024-22412 ClickHouse's Role-based Access Control is bypassed when query caching is enabled.

ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in github.com/clickhouse/clickhouse version 23.1. Query caching bypasses the role based access controls and the policies being enforced on roles...

CVE-2024-22412

ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in github.com/clickhouse/clickhouse version 23.1. Query caching bypasses the role based access controls and the policies being enforced on roles...

CVE-2024-22412: Incorrect Authorization

ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in github.com/clickhouse/clickhouse version 23.1. Query caching bypasses the role based access controls and the policies being enforced on roles...

ClickHouse Security Breach

ClickHouse is ClickHouse's fastest and most resource-efficient open source database for real-time applications and analytics. A security vulnerability exists in ClickHouse prior to 24.1, ClickHouse Cloud prior to 24.0.2.54535, which stems from an access control bypass when query caching is enable...

BIT-CLICKHOUSE-2020-26759

clickhouse-driver before 0.1.5 allows a malicious clickhouse server to trigger a crash or execute arbitrary code on a database client via a crafted server response, due to a buffer overflow...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), dbnd-airflow (0.24.11) +1 more potentially affected by CVE-2024-26280 via apache-airflow (1.10.6)

apache-airflow PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.5.1, =0.5.3 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24.11 Source cves: CVE-2024-26280...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), dbnd-airflow (0.24.11) +1 more potentially affected by CVE-2024-26280 via apache-airflow (1.10.6)

apache-airflow PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.5.1, =0.5.3 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24.11 Source cves: CVE-2024-26280...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), dbnd-airflow (0.24.11) +1 more potentially affected by CVE-2024-27906 via apache-airflow (1.10.6)

apache-airflow PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.5.1, =0.5.3 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24.11 Source cves: CVE-2024-27906...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), airflow-docker (>=1.0.0, <=1.1.0) +5 more potentially affected by CVE-2024-25128 via flask-appbuilder (1.13.1)

flask-appbuilder PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - airflow-clickhouse-plugin =0.5.1, =1.0.0, =1.10.0, =1.10.4b2, =1.10.6 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24....

Fixed in ClickHouse v24.1, 2024-01-30​

When toggling between user roles while using ClickHouse with query cache enabled, there is a risk of obtaining inaccurate data. ClickHouse advises users with vulnerable versions of ClickHouse not to use the query cache when their application dynamically switches between various roles...

PT-2024-19403

Name of the Vulnerable Software and Affected Versions ClickHouse versions prior to 24.0.2.54535 ClickHouse version 23.1 Description A bug exists in ClickHouse that allows query caching to bypass role-based access controls and policies. This means that attackers with control of a role could guess...

CVE-2024-22412

When toggling between user roles while using ClickHouse with query cache enabled, there is a risk of obtaining inaccurate data. ClickHouse advises users with vulnerable versions of ClickHouse not to use the query cache when their application dynamically switches between various roles. Fix has bee...

clickhouse:format_fuzzer: Container-overflow in DB::ParserExpressionImpl::parse

Detailed Report: https://oss-fuzz.com/testcase?key=4991850557538304 Project: clickhouse Fuzzing Engine: libFuzzer Fuzz Target: formatfuzzer Job Type: libfuzzerasanclickhouse Platform Id: linux Crash Type: Container-overflow READ 4 Crash Address: 0x7c6293bc5910 Crash State:...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), dbnd-airflow (0.24.11) +1 more potentially affected by CVE-2023-50943 via apache-airflow (1.10.6)

apache-airflow PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.5.1, =0.5.3 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24.11 Source cves: CVE-2023-50943...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), dbnd-airflow (0.24.11) +1 more potentially affected by CVE-2023-50944 via apache-airflow (1.10.6)

apache-airflow PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.5.1, =0.5.3 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24.11 Source cves: CVE-2023-50944...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), dbnd-airflow (0.24.11) +1 more potentially affected by CVE-2023-50944 via apache-airflow (1.10.6)

apache-airflow PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.5.1, =0.5.3 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24.11 Source cves: CVE-2023-50944...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), dbnd-airflow (0.24.11) +1 more potentially affected by CVE-2023-50943 via apache-airflow (1.10.6)

apache-airflow PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.5.1, =0.5.3 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24.11 Source cves: CVE-2023-50943...

Duplicate Advisory: Exposure of sensitive information in ClickHouse

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-g8ph-74m6-8m7r. This link is maintained to preserve external references. Original Description Exposure of sensitive information in exceptions in ClickHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and...

GHSA-3P77-WG4C-QM24 Duplicate Advisory: Exposure of sensitive information in ClickHouse

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-g8ph-74m6-8m7r. This link is maintained to preserve external references. Original Description Exposure of sensitive information in exceptions in ClickHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and...