Critical Vulnerability in SQLite Package: NULL Pointer Dereference Risk
Summary
ALPINE-CVE-2018-8740: In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c. Affects sqlite versions < 3.13.0-r2. Fixed in 3.13.0-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SQLite is a widely-used, lightweight, and self-contained SQL database engine. It is known for its simplicity and efficiency, making it a popular choice for applications requiring a relational database. However, certain versions of SQLite are vulnerable to a critical issue that can lead to application crashes due to a NULL pointer dereference when handling corrupted database schemas.
Vulnerability Detail
In SQLite versions up to 3.22.0, a vulnerability exists where databases with a corrupted schema, specifically those affected by a CREATE TABLE AS statement, can trigger a NULL pointer dereference. This issue is rooted in the handling of database preparation and building processes, particularly in the build.c and prepare.c files. The ramifications of this vulnerability include potential application crashes and data loss, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
3.13.0-r2
This is the first release that contains the fix.
sudo apk add --upgrade sqliteTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using CREATE TABLE AS statements on potentially corrupted databases until the package can be updated to a secure version.
Conclusion
The vulnerability in SQLite poses a significant risk to applications relying on this database engine. Users are strongly encouraged to update to the latest patched versions to mitigate the risk of crashes and data loss. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for sqlite →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
SQLite versions up to 3.22.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential consequences include application crashes and data loss due to NULL pointer dereference.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlite.
