Critical Vulnerability in SQLite Package: Crash Risk Due to DISTINCT and Window Functions
Summary
ALPINE-CVE-2019-19244: sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage. Affects sqlite versions < 3.28.0-r2. Fixed in 3.28.0-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SQLite is a widely used, lightweight, and self-contained SQL database engine. It is embedded in applications and provides a full-featured SQL implementation. The package is known for its reliability and ease of use, making it a popular choice for developers. However, certain versions of SQLite are vulnerable to a crash when specific SQL queries are executed, particularly those involving DISTINCT and window functions.
Vulnerability Detail
The vulnerability, identified as CVE-2019-19244, originates from the sqlite3Select function in select.c of SQLite version 3.30.1. It allows a crash to occur when a sub-select uses both DISTINCT and window functions alongside certain ORDER BY clauses. This can lead to application instability and potential data loss, making it critical for developers to address this issue promptly.
How To Fix
Minimum fixed version
3.28.0-r2
This is the first release that contains the fix.
sudo apk add --upgrade sqliteTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using DISTINCT in combination with window functions in your SQL queries until the package is updated.
Conclusion
In summary, CVE-2019-19244 poses a significant risk to applications using vulnerable versions of SQLite. Developers should prioritize updating to the patched versions to mitigate the risk of crashes and potential data loss. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for sqlite →
FAQ
CVE-2019-19244 is a vulnerability in SQLite that can cause a crash when executing specific SQL queries involving DISTINCT and window functions.
Affected versions include SQLite 3.30.1 and earlier versions. Fixed versions are available starting from 3.28.0-r2 for v3.10 and 3.30.1-r1 for v3.11 and later.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2019-19244 is 7.5, indicating a high severity level.
If immediate updates are not possible, avoid using the vulnerable SQL features as a temporary workaround until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlite.
