Critical Vulnerability in sqlite3 Package: Denial of Service and Potential Code Execution
Summary
USN-7751-1: sqlite3 vulnerability. Affects sqlite3 versions < 3.45.1-1ubuntu2.5. Fixed in 3.45.1-1ubuntu2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sqlite3 package is a widely used database engine that provides a lightweight, serverless, self-contained SQL database engine. It is known for its efficiency and reliability, making it a popular choice for applications requiring a database. However, vulnerabilities in its extensions, such as FTS5, can lead to significant security risks, including denial of service and arbitrary code execution.
Vulnerability Detail
It was discovered that the FTS5 SQLite extension incorrectly calculated certain array lengths. This flaw could allow an attacker to exploit the vulnerability, leading to a crash of the SQLite engine, resulting in a denial of service. In some cases, it may also enable the execution of arbitrary code, posing a severe risk to applications relying on this database engine.
How To Fix
Minimum fixed version
3.45.1-1ubuntu2.5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade sqlite3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider disabling the FTS5 extension in your SQLite configuration as a temporary workaround. This can help mitigate the risk until the package is updated.
Conclusion
The sqlite3 vulnerability presents a significant risk due to its potential for denial of service and arbitrary code execution. It is crucial for users to update their packages to the patched versions promptly and consider using tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for sqlite3 →
FAQ
The vulnerability involves incorrect calculations in the FTS5 SQLite extension, which can lead to crashes and potential code execution.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Failure to address this vulnerability may result in application crashes, denial of service, and potential unauthorized code execution, compromising the security of your application.
Yes, upgrade to version 3.45.1-1ubuntu2.5 for Ubuntu 24.04 LTS or 3.46.1-3ubuntu0.3 for Ubuntu 25.04 to mitigate the vulnerability.
Yes, you can use the Vulert playground to check for vulnerabilities without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlite3.
