Moderate: sqlite security update
Summary
RLSA-2023:3840: Moderate: sqlite security update. Affects sqlite versions < 0:3.26.0-18.el8_8. Fixed in 0:3.26.0-18.el8_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SQLite is a C library that implements an SQL database engine. It provides a convenient and easy-to-use API for applications to utilize an SQL database without the need for a separate database server. The library supports a large subset of SQL92 and stores the complete database in a single disk file.
Vulnerability Detail
The vulnerability (CVE-2020-24736) in SQLite is caused by a misuse of window functions, leading to a crash. This vulnerability has a CVSS score of 6.2 and can potentially have a moderate impact. Attackers may exploit this vulnerability to cause a denial of service (DoS) condition or execute arbitrary code.
How To Fix
Minimum fixed version
0:3.26.0-18.el8_8
This is the first release that contains the fix.
sudo dnf update sqliteTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
SQLite has released a security update to address a moderate-level vulnerability (CVE-2020-24736) related to the misuse of window functions. It is recommended to update the 'sqlite' package to version 3.26.0-18.el8_8 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sqlite →
FAQ
SQLite is a C library that implements an SQL database engine, providing applications with the functionality of an SQL database without the need for a separate server.
The vulnerability can lead to a crash or allow attackers to execute arbitrary code, potentially causing a denial of service or compromising the system.
To fix this vulnerability, update the 'sqlite' package to version 3.26.0-18.el8_8 or later.
No specific workarounds have been provided for this vulnerability.
You can find more information about this vulnerability in the CVE page(s) listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for sqlite.
