PT-2019-9042 · Yandex · Clickhouse

Andrey Krasichkov + 1 · Published 2019-08-15 · Updated 2025-06-25 · CVE-2018-14671

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ClickHouse versions prior to 18.10.3

Description The issue allows for Remote Code Execution due to unixODBC loading arbitrary shared objects from the file system.

Recommendations For versions prior to 18.10.3, update to version 18.10.3 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-14671

Affected Products

Clickhouse

References · 8

• https://osv.dev/vulnerability/CVE-2018-14671 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-14671 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-14671 · Vendor Advisory
• https://clickhouse.yandex/docs/en/security_changelog · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14671 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14671 · Security Note
• https://t.me/cvenotify/126689 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14671 · Note