CVE-2019-16536 - Vulnerability Details - OpenCVE

Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3.

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://clickhouse.com/docs/whats-new/security-changelog

History

Wed, 21 May 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 21 May 2025 07:30:00 +0000

Type	Values Removed	Values Added
Description		Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3.
Title		Stack overflow leading to DoS can be triggered by a malicious authenticated client.
Weaknesses		CWE-120
References		https://clickhouse.com/docs/whats-new/security-changelog
Metrics		cvssV4_0 `{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H'}`

MITRE

Status: PUBLISHED

Assigner: yandex

Published: 2025-05-21T07:13:15.603Z

Updated: 2025-05-21T13:49:34.919Z

Reserved: 2019-09-19T00:00:00.000Z

Link: CVE-2019-16536

Vulnrichment

Updated: 2025-05-21T13:49:31.746Z

NVD

Status : Awaiting Analysis

Published: 2025-05-21T08:15:26.233

Modified: 2025-05-21T20:24:58.133

Link: CVE-2019-16536

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2019-16536", "assignerOrgId": "a51c9250-e584-488d-808b-03e6f1386796", "state": "PUBLISHED", "assignerShortName": "yandex", "dateReserved": "2019-09-19T00:00:00.000Z", "datePublished": "2025-05-21T07:13:15.603Z", "dateUpdated": "2025-05-21T13:49:34.919Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "DB", "vendor": "Clickhouse", "versions": [{"status": "affected", "version": "19.14.3.3", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Eldar Zaitov of Yandex Information Security Team"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3.</p><br>"}], "value": "Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3."}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.2, "baseSeverity": "HIGH", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-120", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a51c9250-e584-488d-808b-03e6f1386796", "shortName": "yandex", "dateUpdated": "2025-05-21T07:13:15.603Z"}, "references": [{"url": "https://clickhouse.com/docs/whats-new/security-changelog"}], "source": {"discovery": "UNKNOWN"}, "title": "Stack overflow leading to DoS can be triggered by a malicious authenticated client.", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-21T13:49:29.127360Z", "id": "CVE-2019-16536", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-21T13:49:34.919Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2019-16536", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-21T13:49:29.127360Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-21T13:49:31.746Z"}}], "cna": {"title": "Stack overflow leading to DoS can be triggered by a malicious authenticated client.", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Eldar Zaitov of Yandex Information Security Team"}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Clickhouse", "product": "DB", "versions": [{"status": "affected", "version": "19.14.3.3", "versionType": "semver"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}], "references": [{"url": "https://clickhouse.com/docs/whats-new/security-changelog"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3.", "supportingMedia": [{"type": "text/html", "value": "<p>Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3.</p><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-120", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "providerMetadata": {"orgId": "a51c9250-e584-488d-808b-03e6f1386796", "shortName": "yandex", "dateUpdated": "2025-05-21T07:13:15.603Z"}}}, "cveMetadata": {"cveId": "CVE-2019-16536", "state": "PUBLISHED", "dateUpdated": "2025-05-21T13:49:34.919Z", "dateReserved": "2019-09-19T00:00:00.000Z", "assignerOrgId": "a51c9250-e584-488d-808b-03e6f1386796", "datePublished": "2025-05-21T07:13:15.603Z", "assignerShortName": "yandex"}, "dataVersion": "5.1"}