CVE-2019-15024 - In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs, can create a custom-built malicious server that will act as a ClickHouse replica and register it in ZooKeeper

Back Back to CVE browser

MEDIUM

In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs, can create a custom-built malicious server that will act as a ClickHouse replica and register it in ZooKeeper

Published Dec 30, 2019

6.5

MEDIUM

CVSS 3.1

EPSS 0.95%

Description

In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs, can create a custom-built malicious server that will act as a ClickHouse replica and register it in ZooKeeper. When another replica will fetch data part from the malicious replica, it can force clickhouse-server to write to arbitrary path on filesystem.

Affected products

Vendor n/a Product ClickHouse Default
n/a
- Version
  All versions prior to version 19.14.3.
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

ClickHouse

n/a

Version	Status	Constraints
All versions prior to version 19.14.3.	affected	-

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (1)

https://clickhouse.yandex/docs/en/security_changelog/
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://clickhouse.yandex/docs/en/security_changelog/		x_refsource_MISCVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner yandex

Published Dec 30, 2019

Updated Aug 5, 2024

Reserved Aug 13, 2019

Link CVE-2019-15024

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-15024

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-15024