Moderate: sqlite security update
Summary
ALSA-2023:0110: Moderate: sqlite security update. Affects lemon versions < 3.26.0-17.el8_7. Fixed in 3.26.0-17.el8_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SQLite is a C library that implements an SQL database engine. It provides a convenient and easy-to-use API for applications to utilize the power and flexibility of an SQL database without the need for a separate database server. A complete database is stored in a single disk file. SQLite supports a large subset of SQL92.
Vulnerability Detail
The vulnerability (CVE-2022-35737) in SQLite is an array-bounds overflow that occurs when billions of bytes are used in a string argument to a C API. This vulnerability can potentially lead to arbitrary code execution or denial of service attacks. The impact of this vulnerability is considered moderate.
How To Fix
Minimum fixed version
3.26.0-17.el8_7
This is the first release that contains the fix.
sudo dnf update lemonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Updating to the fixed version is the recommended solution.
Conclusion
In conclusion, the SQLite vulnerability (CVE-2022-35737) is a moderate security issue that can lead to arbitrary code execution or denial of service attacks. It is recommended to update the affected packages to version 3.26.0-17.el8_7 or later to fix this vulnerability. If you need further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lemon →
FAQ
SQLite is a C library that implements an SQL database engine. It allows applications to utilize an SQL database without the need for a separate database server.
The vulnerability can potentially lead to arbitrary code execution or denial of service attacks.
Update the affected packages to version 3.26.0-17.el8_7 or later.
No, there is no known workaround. Updating to the fixed version is the recommended solution.
You can find more information about this vulnerability in the CVE page(s) listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for lemon.
