CVE-2024-23689

    Dashboard / Vulnerabilities / CVE-2024-23689

    CVE-2024-23689

    Published: 19 Jan 2024Last Modified: 12 Aug 2026

    Summary: ClickHouse Client Certificate Password Exposure

    Details: Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client exception logs. This occurs when 'sslkey' is specified and an exception, such as a ClickHouseException or SQLException, is thrown during database operations; the certificate password is then included in the logged exception message.

    References: https://github.com/ClickHouse/clickhouse-java/releases/tag/v0.4.6, https://repo.maven.apache.org/maven2, https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23689.json, https://github.com/ClickHouse/clickhouse-java/security/advisories/GHSA-g8ph-74m6-8m7r, https://github.com/advisories/GHSA-g8ph-74m6-8m7r, https://nvd.nist.gov/vuln/detail/CVE-2024-23689, https://vulncheck.com/advisories/vc-advisory-GHSA-g8ph-74m6-8m7r, https://github.com/ClickHouse/clickhouse-java/issues/1331, https://github.com/ClickHouse/clickhouse-java/pull/1334

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -dd91e1776b94a30e32fecf9c82354685295169a6

    Affected versions

    v0.4.5
    v0.4.4
    v0.4.3
    v0.4.2
    v0.4.1
    v0.4.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-23689 | CVE-DB