CVE-2019-18657 - OpenCVE

ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:L/Au:N/C:N/I:P/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Yandex	Clickhouse

Configuration 1 [-]

cpe:2.3:a:yandex:clickhouse:*:*:*:*:*:*:*:*

References

Link	Resource
https://github.com/ClickHouse/ClickHouse/blob/master/CHANGELOG.md	Third Party Advisory
https://github.com/ClickHouse/ClickHouse/pull/6466	Third Party Advisory
https://github.com/ClickHouse/ClickHouse/pull/7526/files	Patch Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2019-10-31T18:55:55

Updated: 2019-10-31T18:55:55

Reserved: 2019-10-31T00:00:00

Link: CVE-2019-18657

JSON object: View

NVD Information

Status : Analyzed

Published: 2019-10-31T19:15:12.687

Modified: 2019-11-06T16:44:45.590

Link: CVE-2019-18657

JSON object: View

Redhat Information

No data.

CWE

CWE-74

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:yandex:clickhouse:*:*:*:*:*:*:*:*", "matchCriteriaId": "1ED4CF1C-B794-4789-ADB6-54383C5BA735", "versionEndExcluding": "19.13.5.44", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function."}, {"lang": "es", "value": "ClickHouse versiones anteriores a 19.13.5.44, permite una inyecci\u00f3n de encabezado HTTP por medio de la funci\u00f3n url table."}], "id": "CVE-2019-18657", "lastModified": "2019-11-06T16:44:45.590", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-10-31T19:15:12.687", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/ClickHouse/ClickHouse/blob/master/CHANGELOG.md"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/ClickHouse/ClickHouse/pull/6466"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/ClickHouse/ClickHouse/pull/7526/files"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}], "source": "nvd@nist.gov", "type": "Primary"}]}