CL
Product
ClickHouse
On CISA KEVExploited in the wild
25
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 5High 12Medium 8Low 0
Watch
Add ClickHouse to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-44011 | 6.5 | Nov 23 | An issue was discovered in ClickHouse before 22.9.1.2603 Affected: before 22.3.12.19; 22.6 before 22.6.6.16; 22.7 before 22.7.4.16; 22.8 before 22.8.2.11; 22.9 before 22.9.1.2603 |
| CVE-2021-42391 | 6.5 | Mar 14 | Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query Affected: before 21.10.2.15 |
| CVE-2021-42390 | 6.5 | Mar 14 | Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query Affected: before 21.10.2.15 |
| CVE-2021-42389 | 6.5 | Mar 14 | Divide-by-zero in Clickhouse's Delta compression codec when parsing a malicious query Affected: before 21.10.2.15 |
| CVE-2019-15024 | 6.5 | Dec 30 | In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs,… Affected: before 19.14.3 |
| CVE-2019-18657 | 5.3 | Oct 31 | ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function Affected: before 19.13.5.44 |
| CVE-2018-14672 | 5.3 | Aug 15 | In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages Affected: before 18.12.13 |
| CVE-2024-22412 | 4.9 | Mar 18 | ClickHouse's Role-based Access Control is bypassed when query caching is enabled. Affected: = 23.1; < 24.0.2.54535 |
Showing 8