PT-2019-9040 · Clickhouse · Clickhouse Mysql Client

Andrey Krasichkov + 1 · Publicado 2019-08-15 · Atualizado 2025-06-25 · CVE-2018-14669

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ClickHouse MySQL client versions prior to 1.1.54390

Description The issue concerns the "LOAD DATA LOCAL INFILE" functionality in the ClickHouse MySQL client, which was enabled and allowed a malicious MySQL database to read arbitrary files from the connected ClickHouse server.

Recommendations For versions prior to 1.1.54390, update to version 1.1.54390 or later to resolve the issue. As a temporary workaround, consider disabling the "LOAD DATA LOCAL INFILE" functionality until a patch is available. Restrict access to sensitive files on the ClickHouse server to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-14669

Produtos afetados

Clickhouse Mysql Client

Referências · 8

• https://clickhouse.yandex/docs/en/security_changelog · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14669 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-14669 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-14669 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-14669 · Aviso do Fabricante
• https://t.me/cvenotify/126687 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2018-14669 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2018-14669 · Nota de Segurança