Clickhouse prior to versions v20.8.18.32-lts, v21.1.9.41-stable, v21.2.9.41-stable, v21.3.6.55-lts, v21.4.3.21-stable allows user to read any file on the host system, that clickhouse user has access to.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 11 | all | clickhouse | < 18.16.1+ds-7.2 | clickhouse_18.16.1+ds-7.2_all.deb |
Debian | 10 | all | clickhouse | < 18.16.1+ds-4 | clickhouse_18.16.1+ds-4_all.deb |
Debian | 999 | all | clickhouse | < 18.16.1+ds-7.2 | clickhouse_18.16.1+ds-7.2_all.deb |