CVE-2024-23689

Description

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-g8ph-74m6-8m7r. This link is maintained to preserve external references. ## Original Description Exposure of sensitive information in exceptions in ClickHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client exception logs. This occurs when 'sslkey' is specified and an exception, such as a ClickHouseException or SQLException, is thrown during database operations; the certificate password is then included in the logged exception message.

How to fix CVE-2024-23689

To remediate CVE-2024-23689, upgrade the affected package to a fixed version below.

—upgrade to 0.4.6 or later
—upgrade to 0.4.6 or later
—upgrade to 0.4.6 or later
—upgrade to 0.4.6 or later
—upgrade to 0.4.6 or later
—upgrade to 0.4.6 or later

Is CVE-2024-23689 being exploited?

Low — EPSS is 1.3%, meaning exploitation activity has not been observed at scale.

Affected packages (6)

from 0, < 0.4.6
from 0, < 0.4.6
from 0, < 0.4.6
from 0, < 0.4.6
from 0, < 0.4.6
from 0, < 0.4.6

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H