Moderate: SQLite security update
Summary
ALSA-2021:4396: Moderate: sqlite security update. Affects lemon versions < 3.26.0-15.el8. Fixed in 3.26.0-15.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SQLite is a C library that implements an SQL database engine. It provides a convenient and easy-to-use API for applications to utilize an SQL database without the need for a separate database server. The library supports a large subset of SQL92 and stores a complete database in a single disk file.
Vulnerability Detail
The vulnerability in SQLite is due to several security issues:
-
Out-of-bounds access: This vulnerability (CVE-2019-5827) is caused by the use of 32-bit memory allocator interfaces, which can lead to unauthorized access to memory.
-
Dropping of shadow tables: In defensive mode, the dropping of shadow tables is not properly restricted, allowing potential attackers to perform unauthorized actions (CVE-2019-13750).
-
FTS3 corruption detection: The FTS3 module in SQLite has an improved detection mechanism for corrupted records (CVE-2019-13751).
-
SELECT statement mishandling: Certain SELECT statements with non-existent VIEW can cause a denial-of-service (DoS) condition (CVE-2019-19603).
-
NULL pointer dereference: A NULL pointer dereference vulnerability (CVE-2020-13435) exists in the sqlite3ExprCodeTarget() function, which can lead to a crash or potential code execution.
How To Fix
Minimum fixed version
3.26.0-15.el8
This is the first release that contains the fix.
sudo dnf update lemonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to apply the security update to ensure the mitigation of the risks.
Conclusion
In conclusion, the SQLite package has been found to have multiple security vulnerabilities. To mitigate these risks, it is crucial to update the package to version 3.26.0-15.el8 or later. Failure to apply the necessary updates may expose systems to unauthorized access, potential unauthorized actions, denial-of-service conditions, and even potential code execution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lemon →
FAQ
SQLite is a C library that implements an SQL database engine. It provides a convenient and easy-to-use API for applications to utilize an SQL database without the need for a separate database server.
The impact of these vulnerabilities can vary depending on the specific circumstances. They can range from unauthorized access to memory, potential unauthorized actions, denial-of-service conditions, and even potential code execution.
There are no known workarounds for these vulnerabilities. It is essential to apply the security update to ensure the mitigation of the risks.
To fix these vulnerabilities, it is recommended to update the SQLite package to version 3.26.0-15.el8 or later. This update includes patches for the identified security issues.
You can find more information about these vulnerabilities, including their impact, CVSS scores, acknowledgments, and related details, on the respective CVE pages: CVE-2019-5827, CVE-2019-13750, CVE-2019-13751, CVE-2019-19603, CVE-2020-13435.
Related vulnerabilities
Recent vulnerabilities recorded for lemon.
