CVE-2024-23689: CWE-209 Generation of Error Message Containing Sensitive Information
Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client exception logs. This occurs when 'sslkey' is specified and an exception, such as a ClickHouseException or SQLException, is thrown during database operations; the certificate password is then included in the logged exception message.
AI Analysis
Technical Summary
This vulnerability (CVE-2024-23689) involves the generation of error messages containing sensitive information (CWE-209) in ClickHouse client libraries: clickhouse-r2dbc, clickhouse-jdbc, and clickhouse-client versions before 0.4.6. When the 'sslkey' parameter is specified and an exception like ClickHouseException or SQLException is thrown during database interactions, the client certificate password is included in the exception's logged message. This allows unauthorized users with access to these logs to obtain sensitive credential information, potentially compromising client authentication security.
Potential Impact
Unauthorized users who can access client exception logs may obtain client certificate passwords, leading to credential compromise. This can result in unauthorized access to database resources or further attacks leveraging the exposed credentials. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H).
Mitigation Recommendations
A fix is available in version 0.4.6 and later. Users should upgrade to clickhouse-r2dbc, clickhouse-jdbc, and clickhouse-client version 0.4.6 or newer to remediate this issue. Until upgraded, avoid logging exception messages that may contain sensitive SSL key passwords or restrict access to such logs to trusted personnel only.
CVE-2024-23689: CWE-209 Generation of Error Message Containing Sensitive Information
Description
Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client exception logs. This occurs when 'sslkey' is specified and an exception, such as a ClickHouseException or SQLException, is thrown during database operations; the certificate password is then included in the logged exception message.
CVSS v3.1
Score 8.8high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2024-23689) involves the generation of error messages containing sensitive information (CWE-209) in ClickHouse client libraries: clickhouse-r2dbc, clickhouse-jdbc, and clickhouse-client versions before 0.4.6. When the 'sslkey' parameter is specified and an exception like ClickHouseException or SQLException is thrown during database interactions, the client certificate password is included in the exception's logged message. This allows unauthorized users with access to these logs to obtain sensitive credential information, potentially compromising client authentication security.
Potential Impact
Unauthorized users who can access client exception logs may obtain client certificate passwords, leading to credential compromise. This can result in unauthorized access to database resources or further attacks leveraging the exposed credentials. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H).
Mitigation Recommendations
A fix is available in version 0.4.6 and later. Users should upgrade to clickhouse-r2dbc, clickhouse-jdbc, and clickhouse-client version 0.4.6 or newer to remediate this issue. Until upgraded, avoid logging exception messages that may contain sensitive SSL key passwords or restrict access to such logs to trusted personnel only.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2024-01-19T17:35:14.200Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6839c41d182aa0cae2b43612
Added to database: 05/30/2025, 14:43:41 UTC
Last enriched: 07/15/2026, 09:47:50 UTC
Last updated: 09/10/2026, 19:36:47 UTC
Views: 96
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.