CVE-2024-23689 ClickHouse Client Certificate Password Exposure
Attackers can read client certificate passwords from exception logs when SSL keys are configured, exposing sensitive credentials in ClickHouse Java libraries.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-23689?
CVE-2024-23689 is a high-severity vulnerability in clickhouse:java_libraries, published on 19 Jan 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client exception logs. This occurs when 'sslkey' is specified and an exception, such as a ClickHouseException or SQLException, is thrown during database operations; the certificate password is then included in the logged exception message.
Weakness: CWE-209
Which versions are affected by CVE-2024-23689?
6 open source packages ship an affected version, including com.clickhouse:clickhouse-client, com.clickhouse:clickhouse-jdbc and com.clickhouse:clickhouse-r2dbc. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.clickhouse:clickhouse-client Maven | All versions | 0.4.6 |
com.clickhouse:clickhouse-client Maven | All versions | 0.4.6 |
com.clickhouse:clickhouse-jdbc Maven | All versions | 0.4.6 |
com.clickhouse:clickhouse-jdbc Maven | All versions | 0.4.6 |
com.clickhouse:clickhouse-r2dbc Maven | All versions | 0.4.6 |
com.clickhouse:clickhouse-r2dbc Maven | All versions | 0.4.6 |
Products include Clickhouse Java Libraries.
How do I fix CVE-2024-23689?
Upgrade com.clickhouse:clickhouse-client to 0.4.6 or later.
Is CVE-2024-23689 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-23689 exists.
Sources
Also known as GHSA-g8ph-74m6-8m7r.