CVE-2024-23689

Katalog CVE

CVSS 8.8 · High EPSS 0,68%

Kerentanan Generation of Error Message Containing Sensitive Information pada clickhouse java libraries. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client exception logs. This occurs when 'sslkey' is specified and an exception, such as a ClickHouseException or SQLException, is thrown during database operations; the certificate password is then included in the logged exception message.

Rincian

Terbit di NVD

19 Januari 2024

Terakhir diubah

14 Juli 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-209: Generation of Error Message Containing Sensitive Information

EPSS (30 hari)

0,68% peluang dieksploitasi; lebih tinggi dari 50,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ClickHouse/clickhouse-java/security/advisories/GHSA-g8ph-74m6-8m7r advisory vendor
• https://github.com/ClickHouse/clickhouse-java/pull/1334 issue tracking · patch
• https://github.com/advisories/GHSA-g8ph-74m6-8m7r advisory pihak ketiga
• https://vulncheck.com/advisories/vc-advisory-GHSA-g8ph-74m6-8m7r advisory pihak ketiga
• https://github.com/ClickHouse/clickhouse-java/issues/1331 exploit · issue tracking
• https://github.com/ClickHouse/clickhouse-java/releases/tag/v0.4.6 release notes