PT-2023-4867 · Unknown · Sqlite-Jdbc

4390C336 · Published 2023-05-23 · Updated 2023-11-10 · CVE-2023-32697

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions sqlite-jdbc versions 3.6.14.1 through 3.41.2.1

Description The issue is related to a remote code execution vulnerability via JDBC URL, which can be exploited by a remote attacker to execute arbitrary code. This is due to incorrect code generation management in the SQLite JDBC library.

Recommendations For versions 3.6.14.1 through 3.41.2.1, update to version 3.41.2.2 to resolve the issue. As a temporary workaround, consider restricting access to the JDBC URL to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2023-05354

CVE-2023-32697

GHSA-6PHF-6H5G-97J2

OESA-2023-1792

Affected Products

Sqlite-Jdbc

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32697.json · Exploit
• https://github.com/xerial/sqlite-jdbc/security/advisories/GHSA-6phf-6h5g-97j2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05354 · Security Note
• https://osv.dev/vulnerability/OESA-2023-1792 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32697 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-32697 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-32697 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6phf-6h5g-97j2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-32697 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-32697 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32697 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-32697 · Vendor Advisory
• https://github.com/xerial/sqlite-jdbc/releases/tag/3.41.2.2 · Note
• https://github.com/xerial/sqlite-jdbc · Note
• https://t.me/cvenotify/51003 · Telegram Post