GHSA-g8ph-74m6-8m7r

Suggest an improvement
Source
https://github.com/advisories/GHSA-g8ph-74m6-8m7r
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-g8ph-74m6-8m7r/GHSA-g8ph-74m6-8m7r.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-g8ph-74m6-8m7r
Aliases
Published
2023-05-12T20:18:51Z
Modified
2024-12-03T06:18:08.519872Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L CVSS Calculator
Summary
ClickHouse vulnerable to client certificate password exposure in client exception
Details

Summary

As initially reported in issue #1331, when client certificate authentication is enabled with password protection, the password (referred to as the client option sslkey) may be exposed in client exceptions (e.g., ClickHouseException or SQLException). This vulnerability can potentially lead to unauthorized access, data breaches, and violations of user privacy.

Details

During the handling of ClickHouseException, the client certificate password may be inadvertently exposed when sslkey is specified. This issue can arise when an exception is thrown during the execution of a query or a database operation. The client certificate password is then included in the exception message, which could be logged or exposed to unauthorized parties.

Impact

This vulnerability enables an attacker with access to client exception error messages or logs to obtain client certificate passwords, potentially allowing unauthorized access to sensitive information, data manipulation, and denial of service attacks. The extent of the risk depends on the specific implementation and usage of the affected systems. However, any exposure of client certificate passwords should be treated as a high-priority security concern.

Database specific
{
    "nvd_published_at": null,
    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-05-12T20:18:51Z"
}
References

Affected packages

Maven / com.clickhouse:clickhouse-client

Package

Name
com.clickhouse:clickhouse-client
View open source insights on deps.dev
Purl
pkg:maven/com.clickhouse/clickhouse-client

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.4.6

Affected versions

0.*

0.3.2
0.3.2-patch1
0.3.2-patch2
0.3.2-patch3
0.3.2-patch4
0.3.2-patch5
0.3.2-patch6
0.3.2-patch7
0.3.2-patch8
0.3.2-patch9
0.3.2-patch10
0.3.2-patch11
0.3.2-test1
0.3.2-test2
0.3.2-test3
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5

Maven / com.clickhouse:clickhouse-jdbc

Package

Name
com.clickhouse:clickhouse-jdbc
View open source insights on deps.dev
Purl
pkg:maven/com.clickhouse/clickhouse-jdbc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.4.6

Affected versions

0.*

0.3.2
0.3.2-patch1
0.3.2-patch2
0.3.2-patch3
0.3.2-patch4
0.3.2-patch5
0.3.2-patch6
0.3.2-patch7
0.3.2-patch8
0.3.2-patch9
0.3.2-patch10
0.3.2-patch11
0.3.2-test1
0.3.2-test2
0.3.2-test3
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5

Maven / com.clickhouse:clickhouse-r2dbc

Package

Name
com.clickhouse:clickhouse-r2dbc
View open source insights on deps.dev
Purl
pkg:maven/com.clickhouse/clickhouse-r2dbc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.4.6

Affected versions

0.*

0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5