GHSA-3p77-wg4c-qm24

Suggest an improvement
Source
https://github.com/advisories/GHSA-3p77-wg4c-qm24
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-3p77-wg4c-qm24/GHSA-3p77-wg4c-qm24.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-3p77-wg4c-qm24
Aliases
Published
2024-01-19T21:30:36Z
Modified
2024-01-30T20:13:29.152960Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Exposure of sensitive information in ClickHouse
Details

Exposure of sensitive information in exceptions in ClickHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client exception logs. This occurs when 'sslkey' is specified and an exception, such as a ClickHouseException or SQLException, is thrown during database operations; the certificate password is then included in the logged exception message.

Database specific 
{
    "nvd_published_at": "2024-01-19T21:15:10Z",
    "cwe_ids": [
        "CWE-209"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-23T14:34:54Z"
}
References

Affected packages

Maven / com.clickhouse:clickhouse-r2dbc

Package

Name
com.clickhouse:clickhouse-r2dbc
View open source insights on deps.dev
Purl
pkg:maven/com.clickhouse/clickhouse-r2dbc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.4.6

Affected versions

0.*

0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5

Maven / com.clickhouse:clickhouse-jdbc

Package

Name
com.clickhouse:clickhouse-jdbc
View open source insights on deps.dev
Purl
pkg:maven/com.clickhouse/clickhouse-jdbc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.4.6

Affected versions

0.*

0.3.2
0.3.2-patch1
0.3.2-patch2
0.3.2-patch3
0.3.2-patch4
0.3.2-patch5
0.3.2-patch6
0.3.2-patch7
0.3.2-patch8
0.3.2-patch9
0.3.2-patch10
0.3.2-patch11
0.3.2-test1
0.3.2-test2
0.3.2-test3
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5

Maven / com.clickhouse:clickhouse-client

Package

Name
com.clickhouse:clickhouse-client
View open source insights on deps.dev
Purl
pkg:maven/com.clickhouse/clickhouse-client

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.4.6

Affected versions

0.*

0.3.2
0.3.2-patch1
0.3.2-patch2
0.3.2-patch3
0.3.2-patch4
0.3.2-patch5
0.3.2-patch6
0.3.2-patch7
0.3.2-patch8
0.3.2-patch9
0.3.2-patch10
0.3.2-patch11
0.3.2-test1
0.3.2-test2
0.3.2-test3
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5