title_wip

### CVE-2018-14669[​](#cve-2018-14669 "Direct link to CVE-2018-14669")

ClickHouse MySQL client had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server.

Credits: Andrey Krasichkov and Evgeny Sidorov of Yandex Information Security Team

## Fixed in ClickHouse Release 1.1.54131, 2017-01-10[​](#fixed-in-clickhouse-release-1-1-54131-2017-01-10 "Direct link to Fixed in ClickHouse Release 1.1.54131, 2017-01-10")

### CVE-2018-14670[​](#cve-2018-14670 "Direct link to CVE-2018-14670")

Incorrect configuration in deb package could lead to the unauthorized use of the database.

Credits: the UK's National Cyber Security Centre (NCSC)

- [Fixed in ClickHouse v25.1.5.5, 2025-01-05](#fixed-in-clickhouse-release-2025-01-05)
  - [CVE-2025-1385](#CVE-2025-1385)- [Fixed in ClickHouse v24.5, 2024-08-01](#fixed-in-clickhouse-release-2024-08-01)
    - [CVE-2024-6873](#CVE-2024-6873)- [Fixed in ClickHouse v24.1, 2024-01-30](#fixed-in-clickhouse-release-24-01-30)
      - [CVE-2024-22412](#CVE-2024-22412)- [Fixed in ClickHouse v23.10.5.20, 2023-11-26](#fixed-in-clickhouse-release-23-10-5-20-2023-11-26)
        - [CVE-2023-47118](#CVE-2023-47118)- [CVE-2023-48298](#CVE-2023-48298)- [CVE-2023-48704](#CVE-2023-48704)- [Fixed in ClickHouse 22.9.1.2603, 2022-09-22](#fixed-in-clickhouse-release-22-9-1-2603-2022-9-22)
          - [CVE-2022-44011](#CVE-2022-44011)- [CVE-2022-44010](#CVE-2022-44010)- [Fixed in ClickHouse 21.10.2.15, 2021-10-18](#fixed-in-clickhouse-release-21-10-2-215-2021-10-18)
            - [CVE-2021-43304](#cve-2021-43304)- [CVE-2021-43305](#cve-2021-43305)- [CVE-2021-42387](#cve-2021-42387)- [CVE-2021-42388](#cve-2021-42388)- [CVE-2021-42389](#cve-2021-42389)- [CVE-2021-42390](#cve-2021-42390)- [CVE-2021-42391](#cve-2021-42391)- [Fixed in ClickHouse 21.4.3.21, 2021-04-12](#fixed-in-clickhouse-release-21-4-3-21-2021-04-12)
              - [CVE-2021-25263](#cve-2021-25263)- [Fixed in ClickHouse Release 19.14.3.3, 2019-09-10](#fixed-in-clickhouse-release-19-14-3-3-2019-09-10)
                - [CVE-2019-15024](#cve-2019-15024)- [CVE-2019-16535](#cve-2019-16535)- [CVE-2019-16536](#cve-2019-16536)- [Fixed in ClickHouse Release 19.13.6.1, 2019-09-20](#fixed-in-clickhouse-release-19-13-6-1-2019-09-20)
                  - [CVE-2019-18657](#cve-2019-18657)- [Fixed in ClickHouse Release 18.12.13, 2018-09-10](#fixed-in-clickhouse-release-18-12-13-2018-09-10)
                    - [CVE-2018-14672](#cve-2018-14672)- [Fixed in ClickHouse Release 18.10.3, 2018-08-13](#fixed-in-clickhouse-release-18-10-3-2018-08-13)
                      - [CVE-2018-14671](#cve-2018-14671)- [Fixed in ClickHouse Release 1.1.54388, 2018-06-28](#fixed-in-clickhouse-release-1-1-54388-2018-06-28)
                        - [CVE-2018-14668](#cve-2018-14668)- [Fixed in ClickHouse Release 1.1.54390, 2018-07-06](#fixed-in-clickhouse-release-1-1-54390-2018-07-06)
                          - [CVE-2018-14669](#cve-2018-14669)- [Fixed in ClickHouse Release 1.1.54131, 2017-01-10](#fixed-in-clickhouse-release-1-1-54131-2017-01-10)
                            - [CVE-2018-14670](#cve-2018-14670)

Was this page helpful?