PT-2019-13937 · Yandex+1 · Clickhouse+1

Eldar Zaitov · Publicado 2019-11-12 · Atualizado 2025-06-25 · CVE-2019-15024

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ClickHouse versions prior to 19.14.3

Description The issue allows an attacker with write access to ZooKeeper and the ability to run a custom server on the network where ClickHouse runs to create a malicious server acting as a ClickHouse replica. This malicious replica can be registered in ZooKeeper, and when another replica fetches data from it, the attacker can force the clickhouse-server to write to an arbitrary path on the filesystem.

Recommendations For versions prior to 19.14.3, update to version 19.14.3 or later to resolve the issue.

Correção

Identificadores relacionados

ALT-PU-2019-3124

CVE-2019-15024

Produtos afetados

Alt Linux

Clickhouse

Referências · 9

• https://errata.altlinux.org/ALT-PU-2019-3124 · Aviso do Fabricante
• https://packages.altlinux.org/ru/vuln/CVE-2019-15024 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-15024 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15024 · Nota
• https://clickhouse.yandex/docs/en/security_changelog · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-15024 · Aviso do Fabricante
• https://t.me/cvenotify/126692 · Publicação no Telegram
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15024 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16535 · Nota de Segurança