REDHAT-BUG-1789595: SQL Injection

Published Jan 9, 2020

Updated

ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind.

References and upstream commits: https://github.com/sqlite/sqlite/commit/1e490c4ca6b43a9cf8637d695907888349f69bec https://github.com/sqlite/sqlite/commit/d8f2d46cbc9925e034a68aaaf60aad788d9373c1

Affected Software

1 affected component

SQLite SQLite

Event History

Jan 9, 2020

Data Sourced

via Red Hat·09:23 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1789595?

The severity of REDHAT-BUG-1789595 is classified as a memory-management error that can lead to potential application instability.

How do I fix REDHAT-BUG-1789595?

To fix REDHAT-BUG-1789595, it is recommended to update to the latest stable version of SQLite that addresses this issue.

Which versions of SQLite are affected by REDHAT-BUG-1789595?

REDHAT-BUG-1789595 affects SQLite version 3.30.1 and potentially earlier versions.

What are the risks of not addressing REDHAT-BUG-1789595?

Not addressing REDHAT-BUG-1789595 can lead to application crashes or unexpected behavior when handling certain filenames.

Is REDHAT-BUG-1789595 a known issue among SQLite users?

Yes, REDHAT-BUG-1789595 is recognized as a known issue and has been documented within the SQLite community.