CyberRota Analysis
AI-GeneratedThe ClickHouse plugin, when utilizing the Native protocol with PDC or secure SOCKS, is vulnerable to plaintext communication due to the connection library's failure to enforce TLS, exposing sensitive data such as usernames, passwords, and queries during transmission. Additionally, the lack of server certificate verification and omission of client certificates further compromise security. Organizations using this plugin should prioritize remediation to protect against potential data interception and unauthorized access.
Original NVD Description
When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never checked, and a configured client certificate is not sent.