ClickHouse/docs/en/security_changelog.md
2020-01-09 12:52:40 +03:00

70 lines
2.5 KiB
Markdown
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

## Fixed in ClickHouse Release 19.14.3.3, 2019-09-10
### CVE-2019-15024
Аn attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs, can create a custom-built malicious server that will act as a ClickHouse replica and register it in ZooKeeper. When another replica will fetch data part from the malicious replica, it can force clickhouse-server to write to arbitrary path on filesystem.
Credits: Eldar Zaitov of Yandex Information Security Team
### CVE-2019-16535
Аn OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve RCE or DoS via native protocol.
Credits: Eldar Zaitov of Yandex Information Security Team
### CVE-2019-16536
Stack overflow leading to DoS can be triggered by malicious authenticated client.
Credits: Eldar Zaitov of Yandex Information Security Team
## Fixed in ClickHouse Release 19.13.6.1, 2019-09-20
### CVE-2019-18657
Table function `url` had the vulnerability allowed the attacker to inject arbitrary HTTP headers in the request.
Credits: [Nikita Tikhomirov](https://github.com/NSTikhomirov)
## Fixed in ClickHouse Release 18.12.13, 2018-09-10
### CVE-2018-14672
Functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages.
Credits: Andrey Krasichkov of Yandex Information Security Team
## Fixed in ClickHouse Release 18.10.3, 2018-08-13
### CVE-2018-14671
unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability.
Credits: Andrey Krasichkov and Evgeny Sidorov of Yandex Information Security Team
## Fixed in ClickHouse Release 1.1.54388, 2018-06-28
### CVE-2018-14668
"remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which led to Cross Protocol Request Forgery Attacks.
Credits: Andrey Krasichkov of Yandex Information Security Team
## Fixed in ClickHouse Release 1.1.54390, 2018-07-06
### CVE-2018-14669
ClickHouse MySQL client had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server.
Credits: Andrey Krasichkov and Evgeny Sidorov of Yandex Information Security Team
## Fixed in ClickHouse Release 1.1.54131, 2017-01-10
### CVE-2018-14670
Incorrect configuration in deb package could lead to unauthorized use of the database.
Credits: the UK's National Cyber Security Centre (NCSC)
[Original article](https://clickhouse.yandex/docs/en/security_changelog/) <!--hide-->