CVE-2024-23689

描述

### Summary As initially reported in issue #1331, when client certificate authentication is enabled with password protection, the password (referred to as the client option `sslkey`) may be exposed in client exceptions (e.g., ClickHouseException or SQLException). This vulnerability can potentially lead to unauthorized access, data breaches, and violations of user privacy. ### Details During the handling of ClickHouseException, the client certificate password may be inadvertently exposed when sslkey is specified. This issue can arise when an exception is thrown during the execution of a query or a database operation. The client certificate password is then included in the exception message, which could be logged or exposed to unauthorized parties. ### Impact This vulnerability enables an attacker with access to client exception error messages or logs to obtain client certificate passwords, potentially allowing unauthorized access to sensitive information, data manipulation, and denial of service attacks. The extent of the risk depends on the specific implementation and usage of the affected systems. However, any exposure of client certificate passwords should be treated as a high-priority security concern.

如何修補 CVE-2024-23689

要修補 CVE-2024-23689,請將受影響套件升級到下列已修補版本。

• —升級至 0.4.6 或更新版本
• —升級至 0.4.6 或更新版本
• —升級至 0.4.6 或更新版本
• —升級至 0.4.6 或更新版本
• —升級至 0.4.6 或更新版本
• —升級至 0.4.6 或更新版本

CVE-2024-23689 正在被利用嗎?

低 — EPSS 為 1.3%,目前沒有觀察到大規模利用活動。