{"affected":[{"defaultStatus":"unaffected","ecosystem":"maven","packageName":"com.clickhouse:clickhouse-r2dbc","product":"","source":"CNA: VulnCheck","vendor":"","versions":[{"lessThan":"0.4.6","status":"affected","version":"0","versionType":"maven"}]},{"defaultStatus":"unaffected","ecosystem":"maven","packageName":"com.clickhouse:clickhouse-jdbc","product":"","source":"CNA: VulnCheck","vendor":"","versions":[{"lessThan":"0.4.6","status":"affected","version":"0","versionType":"maven"}]},{"defaultStatus":"unaffected","ecosystem":"maven","packageName":"com.clickhouse:clickhouse-client","product":"","source":"CNA: VulnCheck","vendor":"","versions":[{"lessThan":"0.4.6","status":"affected","version":"0","versionType":"maven"}]},{"defaultStatus":"unaffected","ecosystem":"Maven","packageName":"com.clickhouse:clickhouse-client","product":"com.clickhouse:clickhouse-client","source":"OSV GHSA-g8ph-74m6-8m7r","vendor":"","versions":[{"status":"affected","version":"0.3.2","versionType":"Maven"},{"status":"affected","version":"0.3.2-patch1","versionType":"Maven"},{"status":"affected","version":"0.3.2-patch10","versionType":"Maven"},{"status":"affected","version":"0.3.2-patch11","versionType":"Maven"},{"status":"affected","version":"0.3.2-patch2","versionType":"Maven"},{"status":"affected","version":"0.3.2-patch3","versionType":"Maven"},{"status":"affected","version":"0.3.2-patch4","versionType":"Maven"},{"status":"affected","version":"0.3.2-patch5","versionType":"Maven"},{"status":"affected","version":"0.3.2-patch6","versionType":"Maven"},{"status":"affected","version":"0.3.2-patch7","versionType":"Maven"},{"status":"affected","version":"0.3.2-patch8","versionType":"Maven"},{"status":"affected","version":"0.3.2-patch9","versionType":"Maven"},{"status":"affected","version":"0.3.2-test1","versionType":"Maven"},{"status":"affected","version":"0.3.2-test2","versionType":"Maven"},{"status":"affected","version":"0.3.2-test3","versionType":"Maven"},{"status":"affected","version":"0.4.0","versionType":"Maven"},{"status":"affected","version":"0.4.1","versionType":"Maven"},{"status":"affected","version":"0.4.2","versionType":"Maven"},{"status":"affected","version":"0.4.3","versionType":"Maven"},{"status":"affected","version":"0.4.4","versionType":"Maven"},{"status":"affected","version":"0.4.5","versionType":"Maven"},{"events":[{"introduced":"0"},{"fixed":"0.4.6"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]},{"defaultStatus":"unaffected","ecosystem":"Maven","packageName":"com.clickhouse:clickhouse-jdbc","product":"com.clickhouse:clickhouse-jdbc","source":"OSV GHSA-g8ph-74m6-8m7r","vendor":"","versions":[{"status":"affected","version":"0.3.2","versionType":"Maven"},{"status":"affected","version":"0.3.2-patch1","versionType":"Maven"},{"status":"affected","version":"0.3.2-patch10","versionType":"Maven"},{"status":"affected","version":"0.3.2-patch11","versionType":"Maven"},{"status":"affected","version":"0.3.2-patch2","versionType":"Maven"},{"status":"affected","version":"0.3.2-patch3","versionType":"Maven"},{"status":"affected","version":"0.3.2-patch4","versionType":"Maven"},{"status":"affected","version":"0.3.2-patch5","versionType":"Maven"},{"status":"affected","version":"0.3.2-patch6","versionType":"Maven"},{"status":"affected","version":"0.3.2-patch7","versionType":"Maven"},{"status":"affected","version":"0.3.2-patch8","versionType":"Maven"},{"status":"affected","version":"0.3.2-patch9","versionType":"Maven"},{"status":"affected","version":"0.3.2-test1","versionType":"Maven"},{"status":"affected","version":"0.3.2-test2","versionType":"Maven"},{"status":"affected","version":"0.3.2-test3","versionType":"Maven"},{"status":"affected","version":"0.4.0","versionType":"Maven"},{"status":"affected","version":"0.4.1","versionType":"Maven"},{"status":"affected","version":"0.4.2","versionType":"Maven"},{"status":"affected","version":"0.4.3","versionType":"Maven"},{"status":"affected","version":"0.4.4","versionType":"Maven"},{"status":"affected","version":"0.4.5","versionType":"Maven"},{"events":[{"introduced":"0"},{"fixed":"0.4.6"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]},{"defaultStatus":"unaffected","ecosystem":"Maven","packageName":"com.clickhouse:clickhouse-r2dbc","product":"com.clickhouse:clickhouse-r2dbc","source":"OSV GHSA-g8ph-74m6-8m7r","vendor":"","versions":[{"status":"affected","version":"0.4.0","versionType":"Maven"},{"status":"affected","version":"0.4.1","versionType":"Maven"},{"status":"affected","version":"0.4.2","versionType":"Maven"},{"status":"affected","version":"0.4.3","versionType":"Maven"},{"status":"affected","version":"0.4.4","versionType":"Maven"},{"status":"affected","version":"0.4.5","versionType":"Maven"},{"events":[{"introduced":"0"},{"fixed":"0.4.6"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2024-23689","cwes":["CWE-209"],"description":"Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client exception logs. This occurs when 'sslkey' is specified and an exception, such as a ClickHouseException or SQLException, is thrown during database operations; the certificate password is then included in the logged exception message.","epss":{"date":"2026-11-08","percentile":0.52498,"score":0.00676},"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794146404227,"publishedAt":1705698149558,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/ClickHouse/clickhouse-java/security/advisories/GHSA-g8ph-74m6-8m7r"},{"source":"CNA: VulnCheck","tags":["issue-tracking"],"url":"https://github.com/ClickHouse/clickhouse-java/issues/1331"},{"source":"CNA: VulnCheck","tags":["issue-tracking","patch"],"url":"https://github.com/ClickHouse/clickhouse-java/pull/1334"},{"source":"CNA: VulnCheck","tags":["related","release-notes"],"url":"https://github.com/ClickHouse/clickhouse-java/releases/tag/v0.4.6"},{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/advisories/GHSA-g8ph-74m6-8m7r"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://vulncheck.com/advisories/vc-advisory-GHSA-g8ph-74m6-8m7r"},{"source":"ADP: CVE","tags":["vendor-advisory","x_transferred"],"url":"https://github.com/ClickHouse/clickhouse-java/security/advisories/GHSA-g8ph-74m6-8m7r"},{"source":"ADP: CVE","tags":["issue-tracking","x_transferred"],"url":"https://github.com/ClickHouse/clickhouse-java/issues/1331"},{"source":"ADP: CVE","tags":["patch","x_transferred"],"url":"https://github.com/ClickHouse/clickhouse-java/pull/1334"},{"source":"ADP: CVE","tags":["related","x_transferred"],"url":"https://github.com/ClickHouse/clickhouse-java/releases/tag/v0.4.6"},{"source":"ADP: CVE","tags":["third-party-advisory","x_transferred"],"url":"https://github.com/advisories/GHSA-g8ph-74m6-8m7r"},{"source":"ADP: CVE","tags":["third-party-advisory","x_transferred"],"url":"https://vulncheck.com/advisories/vc-advisory-GHSA-g8ph-74m6-8m7r"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-g8ph-74m6-8m7r"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-g8ph-74m6-8m7r"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/ClickHouse/clickhouse-java/pull/1334"},{"kind":"fix","source":"ADP: CVE","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/ClickHouse/clickhouse-java/pull/1334"},{"kind":"fix","source":"OSV GHSA-g8ph-74m6-8m7r","text":"com.clickhouse:clickhouse-client (Maven): OSV reports a fixed version 0.4.6. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-g8ph-74m6-8m7r"},{"kind":"fix","source":"OSV GHSA-g8ph-74m6-8m7r","text":"com.clickhouse:clickhouse-jdbc (Maven): OSV reports a fixed version 0.4.6. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-g8ph-74m6-8m7r"},{"kind":"fix","source":"OSV GHSA-g8ph-74m6-8m7r","text":"com.clickhouse:clickhouse-r2dbc (Maven): OSV reports a fixed version 0.4.6. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-g8ph-74m6-8m7r"}],"revision":"bb289d365e6517d3b1ab4a1e0fcd3a1a7b633f55b3cd259abb9b9e50d8350ccc","sources":[{"modifiedAt":1794146404227,"name":"CNA: VulnCheck","retrievedAt":1794146945455,"url":"https://www.cve.org/CVERecord?id=CVE-2024-23689"},{"modifiedAt":1783493587664,"name":"OSV / GitHub Security Advisories","retrievedAt":1794146945841,"url":"https://osv.dev/vulnerability/GHSA-g8ph-74m6-8m7r"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794150557649,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-23689"}],"ssvc":{"assessedAt":1746834960497,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"ClickHouse Client Certificate Password Exposure","updatedAt":1794150557649}