PT-2019-5408 · Sqlite+3 · Sqlite+3
Published
2019-01-14
·
Updated
2019-06-19
·
CVE-2018-20505
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
SQLite version 3.25.2
Description
The issue is related to the execution of queries on a table with a malformed PRIMARY KEY, allowing remote attackers to cause a denial of service by running arbitrary SQL statements. This can be exploited in certain use cases, such as WebSQL, to crash the application. The vulnerability is associated with a lack of protection for the SQL query structure, which can be leveraged by an attacker to cause the application to terminate.
Recommendations
For SQLite version 3.25.2, consider restricting the ability to run arbitrary SQL statements, especially in WebSQL use cases, until a fix is available. As a temporary workaround, avoid using tables with malformed PRIMARY KEY definitions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Sqlite
Ubuntu
Itunes