PT-2019-9040 · Clickhouse · Clickhouse Mysql Client

Andrey Krasichkov + 1 · Published 2019-08-15 · Updated 2025-06-25 · CVE-2018-14669

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ClickHouse MySQL client versions prior to 1.1.54390

Description The issue concerns the "LOAD DATA LOCAL INFILE" functionality in the ClickHouse MySQL client, which was enabled and allowed a malicious MySQL database to read arbitrary files from the connected ClickHouse server.

Recommendations For versions prior to 1.1.54390, update to version 1.1.54390 or later to resolve the issue. As a temporary workaround, consider disabling the "LOAD DATA LOCAL INFILE" functionality until a patch is available. Restrict access to sensitive files on the ClickHouse server to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-14669

Affected Products

Clickhouse Mysql Client

References · 8

• https://clickhouse.yandex/docs/en/security_changelog · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-14669 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14669 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-14669 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14669 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-14669 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14669 · Note
• https://t.me/cvenotify/126687 · Telegram Post