sqlite3: CVE-2022-46908

Debian Bug report logs - #1026293
sqlite3: CVE-2022-46908

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: sqlite3: CVE-2022-46908

Date: Sat, 17 Dec 2022 21:39:53 +0100

Source: sqlite3
Version: 3.40.0-1
Severity: important
Tags: security upstream
Forwarded: https://sqlite.org/forum/forumpost/07beac8056151b2f
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for sqlite3.

CVE-2022-46908[0]:
| SQLite through 3.40.0, when relying on --safe for execution of an
| untrusted CLI script, does not properly implement the
| azProhibitedFunctions protection mechanism, and instead allows UDF
| functions such as WRITEFILE.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2022-46908
    https://www.cve.org/CVERecord?id=CVE-2022-46908
[1] https://sqlite.org/forum/forumpost/07beac8056151b2f
[2] https://sqlite.org/src/info/cefc032473ac5ad2

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at 1026293@bugs.debian.org (full text, mbox, reply):

From: László Böszörményi (GCS) <gcs@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 1026293@bugs.debian.org

Subject: Re: Bug#1026293: sqlite3: CVE-2022-46908

Date: Sun, 18 Dec 2022 10:24:50 +0100

Hi Salvatore,

On Sat, Dec 17, 2022 at 9:42 PM Salvatore Bonaccorso <carnil@debian.org> wrote:
> CVE-2022-46908[0]:
> | SQLite through 3.40.0, when relying on --safe for execution of an
> | untrusted CLI script, does not properly implement the
> | azProhibitedFunctions protection mechanism, and instead allows UDF
> | functions such as WRITEFILE.
 Thanks for reporting! Going to fix it in minutes.

> Please adjust the affected versions in the BTS as needed.
 The report is most probably correct. At least the safe option was
added in 3.37.1 [1] and so this vulnerability does not affect our
stable release which has the older, 3.34.1 version.

Cheers,
Laszlo/GCS
[1] https://www.sqlite.org/releaselog/3_37_1.html

Message #15 received at 1026293@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: László Böszörményi (GCS) <gcs@debian.org>

Cc: 1026293@bugs.debian.org

Subject: Re: Bug#1026293: sqlite3: CVE-2022-46908

Date: Sun, 18 Dec 2022 16:49:25 +0100

Hi László

On Sun, Dec 18, 2022 at 10:24:50AM +0100, László Böszörményi (GCS) wrote:
> Hi Salvatore,
> 
> On Sat, Dec 17, 2022 at 9:42 PM Salvatore Bonaccorso <carnil@debian.org> wrote:
> > CVE-2022-46908[0]:
> > | SQLite through 3.40.0, when relying on --safe for execution of an
> > | untrusted CLI script, does not properly implement the
> > | azProhibitedFunctions protection mechanism, and instead allows UDF
> > | functions such as WRITEFILE.
>  Thanks for reporting! Going to fix it in minutes.
> 
> > Please adjust the affected versions in the BTS as needed.
>  The report is most probably correct. At least the safe option was
> added in 3.37.1 [1] and so this vulnerability does not affect our
> stable release which has the older, 3.34.1 version.

Many thanks for the unstable upload and checking status for bullseye
and older.

Regards,
Salvatore

Send a report that this bug log contains spam.