PT-2019-13937 · Yandex+1 · Clickhouse+1

Eldar Zaitov · Published 2019-11-12 · Updated 2025-06-25 · CVE-2019-15024

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ClickHouse versions prior to 19.14.3

Description The issue allows an attacker with write access to ZooKeeper and the ability to run a custom server on the network where ClickHouse runs to create a malicious server acting as a ClickHouse replica. This malicious replica can be registered in ZooKeeper, and when another replica fetches data from it, the attacker can force the clickhouse-server to write to an arbitrary path on the filesystem.

Recommendations For versions prior to 19.14.3, update to version 19.14.3 or later to resolve the issue.

Fix

Related Identifiers

ALT-PU-2019-3124

CVE-2019-15024

Affected Products

Alt Linux

Clickhouse

References · 9

• https://errata.altlinux.org/ALT-PU-2019-3124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15024 · Security Note
• https://clickhouse.yandex/docs/en/security_changelog · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15024 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15024 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16535 · Security Note
• https://packages.altlinux.org/ru/vuln/CVE-2019-15024 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15024 · Note
• https://t.me/cvenotify/126692 · Telegram Post