REDHAT-BUG-1659379: SQL Injection
Multiple flaws were found in sqlite. An attacker who is able to run arbitrary SQL statements could use this flaw to corrupt the internal databases, which can lead to arbitrary code execution as the user running sqlite.
This issue was fixed via sqlite-3.25.3 release at: https://www.sqlite.org/releaselog/3253.html
Also sqlite-3.36 introduced SQLITEDBCONFIGDEFENSIVE option which when added to the config file, could prevent attackers for corrupting the internal database files. This could however break applications which require users to write these database files. https://www.sqlite.org/releaselog/3260.html https://www.sqlite.org/c3ref/cdbconfigdefensive.html#sqlitedbconfigdefensive
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1659379?
The severity of REDHAT-BUG-1659379 is critical due to the potential for arbitrary code execution.
How do I fix REDHAT-BUG-1659379?
To fix REDHAT-BUG-1659379, update SQLite to version 3.25.3 or later.
What products are affected by REDHAT-BUG-1659379?
The affected products by REDHAT-BUG-1659379 include SQLite versions prior to 3.25.3 and between 3.25.3 and 3.36.
What kind of attack is possible with REDHAT-BUG-1659379?
An attacker can run arbitrary SQL statements that could corrupt internal databases due to REDHAT-BUG-1659379.
What are the implications of exploiting REDHAT-BUG-1659379?
Exploitation of REDHAT-BUG-1659379 could lead to arbitrary code execution with the privileges of the SQLite process.