Critical Vulnerability in SQLite3 Package: Potential Null Pointer Dereference
Summary
UBUNTU-CVE-2020-35525: In SQlite 3.31.1, a potential null pointer derreference was found in the INTERSEC query processing. Affects sqlite3 versions < 3.8.2-1ubuntu2.2+esm4. Fixed in 3.8.2-1ubuntu2.2+esm4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SQLite3 is a widely-used, self-contained, serverless, zero-configuration, transactional SQL database engine. It is known for its simplicity and efficiency, making it a popular choice for applications ranging from small devices to large-scale systems. However, the SQLite3 package has been identified to have a vulnerability that could lead to severe consequences if not addressed promptly.
Vulnerability Detail
In SQLite 3.31.1, a potential null pointer dereference was discovered in the INTERSEC query processing. This vulnerability can lead to application crashes or unexpected behavior, compromising the stability and security of applications relying on SQLite3. The issue arises from improper handling of certain query inputs, which can trigger the dereference of a null pointer, resulting in a denial of service or potential data corruption.
How To Fix
Minimum fixed version
3.8.2-1ubuntu2.2+esm4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade sqlite3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the INTERSEC query until the package is updated. This can help mitigate the risk of encountering the null pointer dereference issue while waiting for a proper fix.
Conclusion
The vulnerability identified in SQLite3 poses a serious risk to applications utilizing this database engine. It is crucial for users to update their SQLite3 packages to the latest patched versions to mitigate potential threats. By staying informed and proactive, users can ensure the security and stability of their applications.
See every vulnerability recorded for sqlite3 →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
The vulnerability affects SQLite3 versions prior to 3.31.1-4ubuntu0.4.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
No subscription is required to access the patched version of SQLite3 for Ubuntu 18.04 LTS and later versions.
Failure to address this vulnerability may lead to application crashes, data corruption, or unauthorized access, significantly impacting the application's reliability and security.
Related vulnerabilities
Recent vulnerabilities recorded for sqlite3.
