New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Early disconnect if there is authentication failure with interserver secret #56794
Merged
alexey-milovidov
merged 8 commits into
master
from
early-exit-interserver-authentication-failure
Nov 17, 2023
Merged
Early disconnect if there is authentication failure with interserver secret #56794
alexey-milovidov
merged 8 commits into
master
from
early-exit-interserver-authentication-failure
Nov 17, 2023
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
alexey-milovidov
added
pr-must-backport
Pull request should be backported intentionally. Use this label with great care!
pr-must-backport-cloud
labels
Nov 15, 2023
robot-ch-test-poll1
added
the
pr-improvement
Pull request with some product improvements
label
Nov 15, 2023
This is an automated comment for commit e49ac4a with description of existing statuses. It's updated for the latest CI running ❌ Click here to open a full report in a separate page Successful checks
|
novikd
approved these changes
Nov 15, 2023
tavplubix
approved these changes
Nov 15, 2023
alexey-milovidov
force-pushed
the
early-exit-interserver-authentication-failure
branch
from
November 15, 2023 23:13
95a92aa
to
3bbb329
Compare
…exit-interserver-authentication-failure
…exit-interserver-authentication-failure
alexey-milovidov
deleted the
early-exit-interserver-authentication-failure
branch
November 17, 2023 12:36
This was referenced Nov 17, 2023
robot-clickhouse-ci-2
added a commit
that referenced
this pull request
Nov 17, 2023
…25cfc9c68d16ad3506d0fab5436438 Cherry pick #56794 to 23.10: Early disconnect if there is authentication failure with interserver secret
robot-clickhouse
added a commit
that referenced
this pull request
Nov 17, 2023
… failure with interserver secret
robot-ch-test-poll4
added a commit
that referenced
this pull request
Nov 17, 2023
…5cfc9c68d16ad3506d0fab5436438 Cherry pick #56794 to 23.3: Early disconnect if there is authentication failure with interserver secret
robot-clickhouse
added a commit
that referenced
this pull request
Nov 17, 2023
…failure with interserver secret
robot-ch-test-poll4
added a commit
that referenced
this pull request
Nov 17, 2023
…5cfc9c68d16ad3506d0fab5436438 Cherry pick #56794 to 23.8: Early disconnect if there is authentication failure with interserver secret
robot-clickhouse
added a commit
that referenced
this pull request
Nov 17, 2023
…failure with interserver secret
robot-ch-test-poll4
added a commit
that referenced
this pull request
Nov 17, 2023
…5cfc9c68d16ad3506d0fab5436438 Cherry pick #56794 to 23.9: Early disconnect if there is authentication failure with interserver secret
robot-clickhouse
added a commit
that referenced
this pull request
Nov 17, 2023
…failure with interserver secret
robot-ch-test-poll4
added
the
pr-backports-created
Backport PRs are successfully created, it won't be processed by CI script anymore
label
Nov 17, 2023
alexey-milovidov
added a commit
that referenced
this pull request
Nov 17, 2023
Backport #56794 to 23.10: Early disconnect if there is authentication failure with interserver secret
alexey-milovidov
added a commit
that referenced
this pull request
Nov 17, 2023
Backport #56794 to 23.9: Early disconnect if there is authentication failure with interserver secret
alexey-milovidov
added a commit
that referenced
this pull request
Nov 17, 2023
Backport #56794 to 23.8: Early disconnect if there is authentication failure with interserver secret
alexey-milovidov
added a commit
that referenced
this pull request
Nov 17, 2023
Backport #56794 to 23.3: Early disconnect if there is authentication failure with interserver secret
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
pr-backports-created
Backport PRs are successfully created, it won't be processed by CI script anymore
pr-backports-created-cloud
pr-improvement
Pull request with some product improvements
pr-must-backport
Pull request should be backported intentionally. Use this label with great care!
pr-must-backport-cloud
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changelog category (leave one):
Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):
There was a potential vulnerability in previous ClickHouse versions: if a user has connected and unsuccessfully tried to authenticate with the "interserver secret" method, the server didn't terminate the connection immediately but continued to receive and ignore the leftover packets from the client. While these packets are ignored, they are still parsed, and if they use a compression method with another known vulnerability, it will lead to exploitation of it without authentication. This issue was found with ClickHouse Bug Bounty Program by https://twitter.com/malacupa