Moderate: sqlite security update
Summary
RLSA-2021:4396: Moderate: sqlite security update. Affects sqlite versions < 0:3.26.0-15.el8. Fixed in 0:3.26.0-15.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
SQLite is a C library that implements an SQL database engine. It provides a convenient and easy-to-use API for applications to utilize the power and flexibility of an SQL database without the need for a separate database server. The vulnerability affects the 'sqlite' package in Rocky Linux 8. The package version prior to 3.26.0-15.el8 is impacted.
Vulnerability Detail
The vulnerability in SQLite is caused by multiple security issues:
-
CVE-2019-5827: This vulnerability is due to the use of 32-bit memory allocator interfaces, leading to out-of-bounds access.
-
CVE-2019-13750: In defensive mode, the dropping of shadow tables is not restricted, allowing unauthorized access.
-
CVE-2019-13751: The FTS3 extension fails to detect corrupted records properly, which can be exploited.
-
CVE-2019-19603: Mishandling of certain SELECT statements with non-existent VIEW can result in a denial-of-service (DoS) condition.
-
CVE-2020-13435: A NULL pointer dereference occurs in the sqlite3ExprCodeTarget() function.
These vulnerabilities can have various impacts, including out-of-bounds access, unauthorized access, DoS attacks, and NULL pointer dereference.
How To Fix
Minimum fixed version
0:3.26.0-15.el8
This is the first release that contains the fix.
sudo dnf update sqliteTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the 'sqlite' package in Rocky Linux 8 is affected by multiple vulnerabilities in SQLite. To mitigate these vulnerabilities, it is recommended to update the package to version 3.26.0-15.el8 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for sqlite →
FAQ
SQLite is a C library that implements an SQL database engine. It allows applications to use an SQL database without the need for a separate database server.
The vulnerabilities can lead to out-of-bounds access, unauthorized access, denial-of-service attacks, and NULL pointer dereference.
To fix the vulnerabilities, update the 'sqlite' package to version 3.26.0-15.el8 or later.
No specific workarounds have been mentioned for these vulnerabilities.
You can refer to the CVE pages listed in the References section for more details about each vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlite.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
