REDHAT-BUG-1787032: SQL Injection
First published: Mon Dec 30 2019(Updated: )
exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled. Reference and upstream commit: <a href="https://github.com/sqlite/sqlite/commit/75e95e1fcd52d3ec8282edb75ac8cd0814095d54">https://github.com/sqlite/sqlite/commit/75e95e1fcd52d3ec8282edb75ac8cd0814095d54</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SQLite JDBC |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/sqlite/sqlite/commit/75e95e1fcd52d3ec8282edb75ac8cd0814095d54
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1787036
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1787034
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1787035
- https://access.redhat.com/errata/RHSA-2020:0514
- https://access.redhat.com/security/cve/cve-2019-19880
- https://bugzilla.redhat.com/show_bug.cgi?id=1787032
Frequently Asked Questions
What is the severity of REDHAT-BUG-1787032?
The severity of REDHAT-BUG-1787032 is considered high due to the potential exploitation of an invalid pointer dereference.
How do I fix REDHAT-BUG-1787032?
To fix REDHAT-BUG-1787032, you should update to the latest version of SQLite that resolves this vulnerability.
Which versions of SQLite are affected by REDHAT-BUG-1787032?
REDHAT-BUG-1787032 affects SQLite version 3.30.1.
What type of vulnerability is REDHAT-BUG-1787032?
REDHAT-BUG-1787032 is an invalid pointer dereference vulnerability that can be triggered by mishandled ORDER BY clauses in window definitions.
Who can be affected by REDHAT-BUG-1787032?
Applications using SQLite 3.30.1 for database management may be affected by REDHAT-BUG-1787032, exposing them to potential attacks.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-19880
- agent/source
- agent/weakness
- agent/severity
- agent/description
- agent/references
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/sqlite
- canonical/sqlite