Описание
A flaw was found in SQLite. A remote attacker could exploit a use-after-free vulnerability in the JSON extraction function. This occurs when the program attempts to access memory after it has been freed, specifically within the JsonParse object. Successful exploitation of this vulnerability can lead to a service crash and a denial of service (DoS) for affected systems.
Отчет
This Moderate flaw in SQLite's JSON extraction function can lead to a denial of service. Applications that process untrusted JSON input using SQLite in Red Hat products are susceptible to a service crash due to a use-after-free vulnerability. This could impact the availability of services relying on SQLite for JSON data handling.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | sqlite | Not affected | ||
| Red Hat Enterprise Linux 6 | sqlite | Affected | ||
| Red Hat Enterprise Linux 7 | sqlite | Affected | ||
| Red Hat Enterprise Linux 8 | mingw-sqlite | Affected | ||
| Red Hat Enterprise Linux 8 | nodejs:22/nodejs | Affected | ||
| Red Hat Enterprise Linux 8 | nodejs:24/nodejs | Affected | ||
| Red Hat Enterprise Linux 8 | rust-toolset:rhel8/rust | Affected | ||
| Red Hat Enterprise Linux 8 | sqlite | Not affected | ||
| Red Hat Enterprise Linux 9 | nodejs:22/nodejs | Affected | ||
| Red Hat Enterprise Linux 9 | nodejs:24/nodejs | Affected |
Показывать по
Дополнительная информация
Статус:
7.5 High
CVSS3
Связанные уязвимости
sqlite 3.41 is vulnerable to use after free in the JSON extraction function. After releasing JsonParse object memory via jsonParseFree(), the program still accesses internal member of the freed pointer, which can cause service crash and denial of service.
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
sqlite 3.41 is vulnerable to use after free in the JSON extraction function. After releasing JsonParse object memory via jsonParseFree(), the program still accesses internal member of the freed pointer, which can cause service crash and denial of service.
7.5 High
CVSS3