SQLite Vulnerability: Inadequate Protection Mechanism in sqlite3 Package
Summary
UBUNTU-CVE-2022-46908: SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE. Affects sqlite3 versions < 3.37.2-2ubuntu0.3. Fixed in 3.37.2-2ubuntu0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SQLite is a widely-used, lightweight database engine that is embedded in applications. It provides a self-contained, serverless, zero-configuration, and transactional SQL database engine. The sqlite3 package is essential for applications that require database functionalities. However, a recent vulnerability has been identified that compromises the security of untrusted CLI scripts executed with SQLite.
Vulnerability Detail
The vulnerability, identified as CVE-2022-46908, affects SQLite versions up to 3.40.0. When using the --safe option for executing untrusted CLI scripts, the azProhibitedFunctions protection mechanism is not properly implemented. This oversight allows User Defined Functions (UDFs) such as WRITEFILE to be executed, potentially leading to unauthorized file access and manipulation. The CVSS score for this vulnerability is 7.3, indicating a high severity level that could result in significant data breaches or system compromises.
How To Fix
Minimum fixed version
3.37.2-2ubuntu0.3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade sqlite3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid executing untrusted CLI scripts with the --safe option until the package is updated. Additionally, review and restrict the use of UDFs in your SQLite scripts to mitigate potential risks.
Conclusion
The CVE-2022-46908 vulnerability in SQLite poses significant risks when executing untrusted CLI scripts. It is crucial to update the sqlite3 package to the latest patched version to ensure the security of your applications. Utilizing tools like Vulert can further enhance your ability to monitor and address vulnerabilities effectively.
See every vulnerability recorded for sqlite3 →
FAQ
CVE-2022-46908 is a vulnerability in SQLite that allows unauthorized execution of User Defined Functions when using the --safe option for untrusted CLI scripts.
The risks include unauthorized file access and manipulation, which could lead to data breaches and system compromises.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
It is recommended to update the sqlite3 package to the patched version 3.37.2-2ubuntu0.3 or later to mitigate the vulnerability.
Vulert monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json, helping developers maintain secure applications.
Related vulnerabilities
Recent vulnerabilities recorded for sqlite3.
