PT-2019-4851 · Sqlite+6 · Sqlite+6

Publicado 2019-12-09 · Atualizado 2022-04-15 · CVE-2019-19924

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SQLite versions 3.30.1

Description The issue is related to the incorrect handling of certain parser trees by the sqlite3WindowRewrite() function in the SQLite database management system. This can be exploited by a remote attacker to impact data integrity. The problem is caused by incorrect error handling in the sqlite3WindowRewrite() function, which is related to the expr.c, vdbeaux.c, and window.c components.

Recommendations For SQLite version 3.30.1, consider applying a patch or fix that corrects the error handling in the sqlite3WindowRewrite() function to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Handling of Exceptional Conditions

Enumeração de Fraquezas

CWE-755

Identificadores relacionados

ALT-PU-2020-1088

ALT-PU-2020-2094

ALT-PU-2020-2183

ALT-PU-2020-2898

BDU:2020-01435

CESA-2020_1810

CVE-2019-19924

OPENSUSE-SU-2021:1058-1

OPENSUSE-SU-2021:2320-1

OPENSUSE-SU-2021_1058-1

OPENSUSE-SU-2021_2320-1

RHSA-2020:1810

RHSA-2020_1810

SUSE-SU-2021:2320-1

SUSE-SU-2021:3215-1

USN-4298-1

Produtos afetados

Alt Linux

Astra Linux

Centos

Red Hat

Sqlite

Suse

Ubuntu

Referências · 94

• https://github.com/sqlite/sqlite/commit/57f7ece78410a8aae86aa4625fb7556897db384c · Nota
• https://github.com/sqlite/sqlite/commit/8654186b0236d556aa85528c2573ee0b6ab71be3 · Correção
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20200429SE81 · Aviso do Fabricante
• https://bugzilla.suse.com/1158959 · Nota
• https://suse.com/security/cve/CVE-2020-15358 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2021:1058-1 · Aviso do Fabricante
• https://bugzilla.suse.com/928700 · Nota
• https://security-tracker.debian.org/tracker/CVE-2019-19924 · Aviso do Fabricante
• https://bugzilla.suse.com/1159715 · Nota
• https://suse.com/security/cve/CVE-2019-19646 · Nota
• https://ubuntu.com/security/CVE-2020-9327 · Aviso do Fabricante
• https://bugzilla.suse.com/1173641 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2021:3215-1 · Aviso do Fabricante
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E · Nota
• https://suse.com/security/cve/CVE-2019-8457 · Nota