PT-2019-9042 · Yandex · Clickhouse

Name of the Vulnerable Software and Affected Versions: ClickHouse versions prior to 18.10.3 Description: The issue allows for Remote Code Execution due to unixODBC loading arbitrary shared objects from the file system. Recommendations: For versions prior to 18.10.3, update to version 18.10.3 or...

PT-2019-9043 · Yandex · Clickhouse

Name of the Vulnerable Software and Affected Versions: ClickHouse versions prior to 18.12.13 Description: The issue allows path traversal and reading of arbitrary files through error messages in functions for loading CatBoost models. Recommendations: For versions prior to 18.12.13, update to...

PT-2019-9039 · Yandex · Clickhouse

Name of the Vulnerable Software and Affected Versions: ClickHouse versions prior to 1.1.54388 Description: The issue allows for Cross Protocol Request Forgery Attacks due to the "remote" table function permitting arbitrary symbols in the user, password, and default database fields. Recommendation...

CVE-2018-14672: Improper Limitation of a Pathname to a Restricted Directory

In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages...

CVE-2018-14671: Improper Input Validation

In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability...

CVE-2018-14669: Exposure of Sensitive Information to an Unauthorized Actor

ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server...

CVE-2018-14668: Cross-Site Request Forgery (CSRF)

In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "defaultdatabase" fields which led to Cross Protocol Request Forgery Attacks...

CVE-2018-14670: Improper Authorization

Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database...

WS-2019-0377

In ClickHouse, v53973 to v19.13.1.961-testing there is a directory traversal vulnerability that affects the “fileout” variable that adds to parts of a given path “absolutepartpath” + “filename” that one of those parts is the user’s input. It could lead to the disclosure of sensitive data and othe...

WS-2019-0378

In ClickHouse, v53973 to v19.13.1.961-testing there is a directory traversal vulnerability that affects the “fileout” variable that adds to a given path “absolutepartpath” + “filename”, one of those parts is the user’s input. It could lead to the disclosure of sensitive data and other malicious...

WS-2019-0376

In Clickhouse, v1.1.54372-testing to v19.2.0-testing the function “getQueryFromMetadata” is vulnerable to a race condition vulnerability called “TOCTOU”. This vulnerability, when exploited, may allow an attacker to potentially read and disclose information from a file within the file system, with...

Fixed in ClickHouse Release 18.12.13, 2018-09-10 

Functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages...

Fixed in ClickHouse Release 18.12.13, 2018-09-10​

Functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages...

Fixed in ClickHouse Release 18.10.3, 2018-08-13 

unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability...

Fixed in ClickHouse Release 18.10.3, 2018-08-13​

unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability...

Fixed in ClickHouse Release 1.1.54390, 2018-07-06 

ClickHouse MySQL client had “LOAD DATA LOCAL INFILE” functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server...

Fixed in ClickHouse Release 1.1.54390, 2018-07-06​

ClickHouse MySQL client had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server...

CVE-2018-14669

ClickHouse MySQL client had “LOAD DATA LOCAL INFILE” functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server. Andrey Krasichkov and Evgeny Sidorov of Yandex Information Security Team...

WS-2018-0624

In ClickHouse, 53973 to v1.1.54389-testing there is a vulnerability allowing a malicious server/proxy to send a fake “local infile request” packet to the client and read any file that the client has permission to open...

Fixed in ClickHouse Release 1.1.54388, 2018-06-28 

“remote” table function allowed arbitrary symbols in “user”, “password” and “defaultdatabase” fields which led to Cross Protocol Request Forgery Attacks...