CVE-2023-32697: Sqlite-jdbc vulnerable to remote code execution when JDBC url is attacker controlled

Reference Links

• https://github.com/xerial/sqlite-jdbc/releases/tag/3.41.2.2
• https://github.com/xerial/sqlite-jdbc/security/advisories/GHSA-6phf-6h5g-97j2
• https://exchange.xforce.ibmcloud.com/vulnerabilities/256159
• https://www.ibm.com/support/pages/node/7049133 (Advisory)
• https://nvd.nist.gov/vuln/detail/CVE-2023-32697
• https://github.com/advisories/GHSA-6phf-6h5g-97j2 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• IBM-7049133

Frequently Asked Questions

• What is CVE-2023-32697?

  CVE-2023-32697 is a vulnerability in SQLite JDBC that allows a remote authenticated attacker to execute arbitrary code on the system by exploiting a flaw in the JDBC URL.

• How does CVE-2023-32697 affect the system?

  CVE-2023-32697 can be exploited by a remote attacker to execute arbitrary code on the system by sending a specially crafted request.

• What is the severity of CVE-2023-32697?

  The severity of CVE-2023-32697 is high, with a CVSS score of 8.8.

• Which software versions are affected by CVE-2023-32697?

  The affected software versions include org.xerial:sqlite-jdbc version 3.6.14.1 up to (but not including) 3.41.2.2, and IBM QRadar SIEM version 7.5.0 UP6.

• How can I fix CVE-2023-32697?

  To fix CVE-2023-32697, update to the remedy version 3.41.2.2 for org.xerial:sqlite-jdbc package and update to a version beyond 7.5.0 UP6 for IBM QRadar SIEM.