Unscored CVE-2018-14669 EUVD-2018-6563GHSA-7j36-vrpv-9wqr

ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL databas…

Published Aug 15, 2019 · Updated Aug 5, 2024 · Assigned by yandex

Description

ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server.

Affected products

Vendor	Product	Affected	Fixed
—	ClickHouse	All versions prior to version 1.1.54390.	—

References

https://clickhouse.yandex/docs/en/security_changelog/