Security fixes will be announced by posting them in the security changelog
The following versions of ClickHouse server are currently being supported with security updates:
| Version | Supported |
|---|---|
| 1.x | ❌ |
| 18.x | ❌ |
| 19.x | ❌ |
| 20.1 | ❌ |
| 20.3 | ❌ |
| 20.4 | ❌ |
| 20.5 | ❌ |
| 20.6 | ❌ |
| 20.7 | ❌ |
| 20.8 | ❌ |
| 20.9 | ❌ |
| 20.10 | ❌ |
| 20.11 | ❌ |
| 20.12 | ❌ |
| 21.1 | ❌ |
| 21.2 | ❌ |
| 21.3 | ✅ |
| 21.4 | ❌ |
| 21.5 | ❌ |
| 21.6 | ✅ |
| 21.7 | ✅ |
| 21.8 | ✅ |
We're extremely grateful for security researchers and users that report vulnerabilities to the ClickHouse Open Source Community. All reports are thoroughly investigated by developers.
To report a potential vulnerability in ClickHouse please send the details about it to clickhouse-feedback@yandex-team.com.
- You think you discovered a potential security vulnerability in ClickHouse
- You are unsure how a vulnerability affects ClickHouse
- You need help tuning ClickHouse components for security
- You need help applying security related updates
- Your issue is not security related
Each report is acknowledged and analyzed by ClickHouse maintainers within 5 working days. As the security issue moves from triage, to identified fix, to release planning we will keep the reporter updated.
A public disclosure date is negotiated by the ClickHouse maintainers and the bug submitter. We prefer to fully disclose the bug as soon as possible once a user mitigation is available. It is reasonable to delay disclosure when the bug or the fix is not yet fully understood, the solution is not well-tested, or for vendor coordination. The timeframe for disclosure is from immediate (especially if it's already publicly known) to 90 days. For a vulnerability with a straightforward mitigation, we expect report date to disclosure date to be on the order of 7 days.