CVE-2022-46908: SQL Injection
Last updated 24 July 2024
Other sources
SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/sqlite3to a version that resolves this vulnerability.Fixed in 3.34.1-3Fixed in 3.34.1-3+deb11u1Fixed in 3.40.1-2Fixed in 3.46.0-1Fixed in 3.46.1-1
Event History
Frequently Asked Questions
What is CVE-2022-46908?
CVE-2022-46908 is a vulnerability in SQLite through version 3.40.0 that allows UDF functions such as WRITEFILE when relying on --safe for execution of an untrusted CLI script.
What is the severity of CVE-2022-46908?
The severity of CVE-2022-46908 is high, with a severity rating of 7.3.
How does CVE-2022-46908 affect SQLite?
CVE-2022-46908 affects SQLite through version 3.40.0, specifically when relying on --safe for execution of an untrusted CLI script.
What is the recommended solution for CVE-2022-46908?
To mitigate the vulnerability, it is recommended to update SQLite to version 3.40.1 or later.
Where can I find more information about CVE-2022-46908?
More information about CVE-2022-46908 can be found at the following references: [link1], [link2], [link3].