Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2018-14672

In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
yandex

Description

In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a ClickHouse

  • All versions prior to version 18.12.13.affected

References