CVE-2022-21227: Denial of Service (DoS)
Affected versions of sqlite3 will experience a fatal error when supplying a specific object in the parameter array. This error causes the application to crash and could not be caught. Users of sqlite3 v5.0.0, v5.0.1 and v5.0.2 are affected by this. This issue is fixed in v5.0.3. All users are recommended to upgrade to v5.0.3 or later. Ensure there is sufficient sanitization in the parent application to protect against invalid values being supplied to binding parameters as a workaround.
Other sources
The package sqlite3 before 5.0.3 are vulnerable to Denial of Service (DoS) which will invoke the toString function of the passed parameter. If passed an invalid Function object it will throw and crash the V8 engine.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/node-sqlite3to a version that resolves this vulnerability.Fixed in 5.1.5+ds1-1Fixed in 6.0.1+ds1-1 - Upgrade
Upgrade
npm/sqlite3to a version that resolves this vulnerability.Fixed in 5.0.3 - Upgrade
Upgrade
debian/node-sqlite3to a version that resolves this vulnerability.Fixed in 5.0.6+ds1-1 - Upgrade
Upgrade
sqlite3to a version that resolves this vulnerability.Fixed in 5.0.3 - Compensating control
Sanitize values in the parent application before supplying them as binding parameters to prevent invalid values, including invalid Function objects, from reaching sqlite3.
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-21227.
What is the severity of CVE-2022-21227?
The severity of CVE-2022-21227 is high, with a severity value of 7.5.
What is the affected software?
The affected software is Ghost Sqlite3 with versions before 5.0.3 on Node.js.
How does CVE-2022-21227 affect the system?
CVE-2022-21227 can cause a Denial of Service (DoS) by invoking the toString function of an invalid Function object, potentially crashing the V8 engine.
How can CVE-2022-21227 be mitigated?
To mitigate CVE-2022-21227, it is recommended to update the sqlite3 package to version 5.0.3 or newer.