Описание
In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.
A flaw was found in SQLite. This vulnerability allows an attacker to cause an integer overflow via the concat_ws function.
Отчет
Within regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-190: Integer Overflow or Wraparound vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low. Baseline configurations and configuration controls enforce secure system and software settings, while least functionality reduces the attack surface by disabling unnecessary services and ports. In the event of successful exploitation, process isolation ensures that memory corruption is contained within the originating process, preventing it from affecting other processes or the system as a whole. The environment leverages malicious code protections such as IPS/IDS and antimalware solutions. These controls help detect and prevent malicious code that attempts to exploit integer overflow vulnerabilities through mechanisms like file integrity checks and patch management. Finally, memory protection mechanisms such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) are used to enhance resilience against integer overflows and denial-of-service attacks. RHEL/UBI 9 ships SQLite version 3.34.1, which is not affected by this CVE.This vulnerability only exists in SQLite versions 3.44.0 through 3.49.0.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | sqlite | Fix deferred | ||
| Red Hat Enterprise Linux 6 | sqlite | Out of support scope | ||
| Red Hat Enterprise Linux 7 | sqlite | Out of support scope | ||
| Red Hat Enterprise Linux 8 | mingw-sqlite | Not affected | ||
| Red Hat Enterprise Linux 8 | nodejs:22/nodejs | Fix deferred | ||
| Red Hat Enterprise Linux 8 | rust-toolset:rhel8/rust | Fix deferred | ||
| Red Hat Enterprise Linux 8 | sqlite | Not affected | ||
| Red Hat Enterprise Linux 9 | nodejs:22/nodejs | Fix deferred | ||
| Red Hat Enterprise Linux 9 | rust | Fix deferred | ||
| Red Hat Enterprise Linux 9 | sqlite | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.
In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.
In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL fun ...
Sqlite 3.49.0 is susceptible to integer overflow through the concat function.
Уязвимость функции SQL concat_ws() системы управления базами данных SQLite, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
5.5 Medium
CVSS3