CVE-2025-1385

Name	CVE-2025-1385
Description	When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server. You can check if your ClickHouse server is vulnerable to this vulnerability by inspecting the configuration file and confirming if the following setting is enabled: <library_bridge> <port>9019</port> </library_bridge>
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
clickhouse (PTS)	bullseye	18.16.1+ds-7.2+deb11u1	fixed
	bookworm	18.16.1+ds-7.3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
clickhouse	source	(unstable)	(not affected)

Notes

- clickhouse <not-affected> (Library bridge was introduced in Clickhouse 21)
https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-5phv-x8x4-83x5
https://github.com/ClickHouse/ClickHouse/pull/75954