PT-2019-4848 · Sqlite+5 · Sqlite+5

Published 2019-12-09 · Updated 2022-04-15 · CVE-2019-19645

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SQLite versions prior to 3.30.1

Description The issue is related to a type determination error in the SQLite database management system. It can be triggered by certain types of self-referential views in conjunction with ALTER TABLE statements, allowing attackers to cause infinite recursion. This can lead to a denial of service.

Recommendations For versions prior to 3.30.1, update to a version that contains a fix for this issue to prevent potential denial of service attacks.

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

ALT-PU-2020-1088

ALT-PU-2020-2094

ALT-PU-2020-2183

ALT-PU-2020-2898

AZL-39010

BDU:2020-01432

CVE-2019-19645

OPENSUSE-SU-2021:1058-1

OPENSUSE-SU-2021:2320-1

OPENSUSE-SU-2021_1058-1

OPENSUSE-SU-2021_2320-1

SUSE-SU-2021:2320-1

SUSE-SU-2021:3215-1

USN-4394-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Sqlite

Suse

Ubuntu

References · 88

• https://github.com/sqlite/sqlite/commit/38096961c7cd109110ac21d3ed7dad7e0cb0ae06 · Patch
• https://osv.dev/vulnerability/CVE-2019-19645 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-8740 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13630 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-19645 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0926SE47 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-19645 · Security Note
• https://ubuntu.com/security/CVE-2019-19645 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:3215-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13435 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4394-1 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=71831011 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-19645 · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2020.html · Patch
• https://usn.ubuntu.com/4394-1 · Vendor Advisory