PT-2019-9043 · Yandex · Clickhouse

Name of the Vulnerable Software and Affected Versions: ClickHouse versions prior to 18.12.13 Description: The issue allows path traversal and reading of arbitrary files through error messages in functions for loading CatBoost models. Recommendations: For versions prior to 18.12.13, update to...

ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +26917 more potentially affected by CVE-2018-12022 via com.fasterxml.jackson.core:jackson-databind (>=2.0.0-rc1, <=2.7.9.3)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.0.0-rc1, =0.1, =0.3.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =0.0.115 and more Source cves:...

Fixed in ClickHouse Release 18.12.13, 2018-09-10 

Functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages...

Fixed in ClickHouse Release 18.12.13, 2018-09-10​

Functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages...

CVE-2018-14672

Functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages. Andrey Krasichkov of Yandex Information Security Team...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.6), ai.catboost:catboost-spark_3.1_2.12 (>=1.0.1, <=1.2.8) +23049 more potentially affected by CVE-2014-0114 via commons-beanutils:commons-beanutils (>=1.8.0, <=1.9.3)

commons-beanutils:commons-beanutils MAVEN version =1.8.0, =0.0.1, =1.0.1, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =chaining-0.0.46-dev, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =thread-pool-0.0.24-dev, =0.0.6, =0.1.12, =0.0.2, =0.7.0,...