Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0zcDc3LXdnNGMtcW0yNM4AA4lo

Exposure of sensitive information in ClickHouse

Exposure of sensitive information in exceptions in ClickHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client exception logs. This occurs when 'sslkey' is specified and an exception, such as a ClickHouseException or SQLException, is thrown during database operations; the certificate password is then included in the logged exception message.

Permalink: https://github.com/advisories/GHSA-3p77-wg4c-qm24
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zcDc3LXdnNGMtcW0yNM4AA4lo
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 11 months ago
Updated: 10 months ago

CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-3p77-wg4c-qm24, CVE-2024-23689
References:

• https://github.com/ClickHouse/clickhouse-java/security/advisories/GHSA-g8ph-74m6-8m7r
• https://nvd.nist.gov/vuln/detail/CVE-2024-23689
• https://github.com/ClickHouse/clickhouse-java/issues/1331
• https://github.com/ClickHouse/clickhouse-java/pull/1334
• https://github.com/ClickHouse/clickhouse-java/releases/tag/v0.4.6
• https://github.com/advisories/GHSA-g8ph-74m6-8m7r
• https://vulncheck.com/advisories/vc-advisory-GHSA-g8ph-74m6-8m7r
• https://github.com/advisories/GHSA-3p77-wg4c-qm24

Repository: https://github.com/ClickHouse/clickhouse-java
Blast Radius: 21.6

Affected Packages