Vulnerability · Published Jan 6, 2021 · Assigned by mitre
CVE-2020-26759
Critical 9.8
In plain English
A critical-severity security flaw in the python-clickhouse-driver package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)2.7%top 14.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
clickhouse-driver before 0.1.5 allows a malicious clickhouse server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, due to a buffer overflow.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-clickhouse-driver | 0.2.0-1 | DEBIAN-CVE-2020-26759 |
| Debian:13 | python-clickhouse-driver | 0.2.0-1 | DEBIAN-CVE-2020-26759 |
| Debian:14 | python-clickhouse-driver | 0.2.0-1 | DEBIAN-CVE-2020-26759 |
| PyPI | clickhouse-driver | 0.1.5 | GHSA-vgv5-cxvh-vfxh |
| PyPI | clickhouse-driver | 0.1.5 | PYSEC-2021-61 |
| Ubuntu:22.04:LTS | python-clickhouse-driver | 0.2.0-1 | UBUNTU-CVE-2020-26759 |