SQLite up to 3.40.0 Safe Execution azProhibitedFunctions protection mechanism

Summaryinfo

A vulnerability has been found in SQLite up to 3.40.0 and classified as critical. This vulnerability affects the function azProhibitedFunctions of the component Safe Execution Handler. Performing a manipulation results in protection mechanism. This vulnerability is known as CVE-2022-46908. No exploit is available.

Detailsinfo

A vulnerability was found in SQLite up to 3.40.0. It has been classified as critical. This affects the function azProhibitedFunctions of the component Safe Execution Handler. The manipulation with an unknown input leads to a protection mechanism vulnerability. CWE is classifying the issue as CWE-693. The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. The impact remains unknown. The summary by CVE is:

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.

The weakness was published 12/12/2022. It is possible to read the advisory at news.ycombinator.com. This vulnerability is uniquely identified as CVE-2022-46908 since 12/12/2022. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 235883 (Amazon Linux 2023 : lemon, sqlite, sqlite-analyzer (ALAS2023-2025-971)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (235883). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• SQLite

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23
• 3.24
• 3.25
• 3.26
• 3.27
• 3.28
• 3.29
• 3.30
• 3.31
• 3.32
• 3.33
• 3.34
• 3.35
• 3.36
• 3.37
• 3.38
• 3.39
• 3.40.0

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion