Moderate: SQLite security update for Rocky Linux:8
Summary
RLSA-2022:7108: Moderate: sqlite security update. Affects sqlite versions < 0:3.26.0-16.el8_6. Fixed in 0:3.26.0-16.el8_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SQLite is a C library that implements an SQL database engine. It provides a convenient and easy-to-use API for applications to utilize the power and flexibility of an SQL database without the need for a separate database server. The vulnerability affects the SQLite package in Rocky Linux:8.
Vulnerability Detail
The vulnerability in SQLite is categorized as moderate and has a CVSS score of 8.1. It includes two security fixes:
-
CVE-2020-35527: Out of bounds access during table rename This vulnerability allows an attacker to perform out-of-bounds memory access during a table rename operation in SQLite.
-
CVE-2020-35525: Null pointer dereference in src/select.c This vulnerability can lead to a null pointer dereference in the select.c source file of SQLite.
These vulnerabilities can potentially be exploited by attackers to execute arbitrary code, cause a denial of service, or disclose sensitive information.
How To Fix
Minimum fixed version
0:3.26.0-16.el8_6
This is the first release that contains the fix.
sudo dnf update sqliteTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
SQLite in Rocky Linux:8 is affected by two moderate vulnerabilities. It is recommended to update the SQLite package to version 3.26.0-16.el8_6 or later to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sqlite →
FAQ
SQLite is a C library that implements an SQL database engine. It provides a convenient and easy-to-use API for applications to utilize the power and flexibility of an SQL database without the need for a separate database server.
CVE-2020-35527 allows an attacker to perform out-of-bounds memory access during a table rename operation in SQLite. This can potentially lead to arbitrary code execution, denial of service, or information disclosure.
CVE-2020-35525 can lead to a null pointer dereference in the select.c source file of SQLite. This vulnerability can potentially be exploited to cause a denial of service.
To fix the vulnerabilities, update the SQLite package to version 3.26.0-16.el8_6 or later by following the package update process for Rocky Linux:8.
No specific workarounds have been mentioned for these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for sqlite.
