REDHAT-BUG-1768986: SQL Injection
First published: Tue Nov 05 2019(Updated: )
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner." References: <a href="https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg116312.html">https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg116312.html</a> <a href="https://www.sqlite.org/src/info/e4598ecbdd18bd82945f6029013296690e719a62">https://www.sqlite.org/src/info/e4598ecbdd18bd82945f6029013296690e719a62</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SQLite JDBC | <=3.29.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg116312.html
- https://www.sqlite.org/src/info/e4598ecbdd18bd82945f6029013296690e719a62
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1768989
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1768988
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1768987
- https://access.redhat.com/errata/RHSA-2020:4442
- https://access.redhat.com/security/cve/cve-2019-16168
- https://access.redhat.com/errata/RHSA-2021:1968
- https://bugzilla.redhat.com/show_bug.cgi?id=1768986
Frequently Asked Questions
What is the severity of REDHAT-BUG-1768986?
The severity of REDHAT-BUG-1768986 is considered severe due to a potential division by zero error in the query planner.
How does REDHAT-BUG-1768986 impact SQLite users?
REDHAT-BUG-1768986 can cause crashes in browsers or applications that use SQLite due to improper validation.
What is the version of SQLite affected by REDHAT-BUG-1768986?
SQLite versions up to and including 3.29.0 are affected by REDHAT-BUG-1768986.
How can I mitigate the risks associated with REDHAT-BUG-1768986?
Mitigation for REDHAT-BUG-1768986 involves upgrading SQLite to a version later than 3.29.0.
What does the REDHAT-BUG-1768986 vulnerability involve specifically?
REDHAT-BUG-1768986 involves missing validation of a sqlite_stat1 sz field, leading to potential crashes.
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-16168
- agent/source
- agent/severity
- agent/weakness
- agent/description
- agent/references
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/sqlite
- canonical/sqlite