CVE-2019-8457CWE-125

CVE-2019-8457

Critical · published May 30, 2019

CVSS v3.1
9.8
EPSS
45%
Percentile
98.8
In the wild
Unconfirmed
What it is

⚠️ An unexpected out-of-bounds read in SQLite3 could expose sensitive data like a misplaced library book! 📚 Think of SQLite3 as a library where each book represents a piece of data. If someone tries to read a book that’s been misfiled or doesn’t exist, they might accidentally peek into the librarian’s notes instead—this out-of-bounds read could reveal sensitive information they shouldn’t see. An attacker could exploit this vulnerability to read potentially sensitive data from memory, causing a serious breach of confidentiality. While it doesn't lead to remote code execution, the leaked information could still be damaging, especially if it contains private user data or application secrets.

Put simply

Think of SQLite3 as a library where each book represents a piece of data. If someone tries to read a book that’s been misfiled or doesn’t exist, they might accidentally peek into the librarian’s notes instead—this out-of-bounds read could reveal sensitive information they shouldn’t see. The vulnerability occurs in SQLite3 versions 3.6.0 to 3.27.2 in the `rtreenode()` function, which improperly handles invalid rtree tables, allowing for an out-of-bounds read.

What to do

An attacker could exploit this vulnerability to read potentially sensitive data from memory, causing a serious breach of confidentiality. While it doesn't lead to remote code execution, the leaked information could still be damaging, especially if it contains private user data or application secrets. Upgrade SQLite3 to the latest version to ensure you’re protected against this vulnerability. If you're maintaining software that relies on SQLite3, make it a priority to check your dependencies and apply the latest patches. 🚀 You've got this! Stay proactive and secure your SQLite3 installations! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.45426 · 98.8th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2019-05-30T20:29Z
Affected products (9)
ProductVersionsFixed in
sqlite/sqlite≥ 3.6.0, ≤ 3.27.2—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
opensuse/leapall versions—
References (31)
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00074.html · [email protected]https://kc.mcafee.com/corporate/index?page=content&id=SB10365 · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPKYSWCOM3CL66RI76TYVIG6TJ263RXH/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJPFGA45DI4F5MCF2OAACGH3HQOF4G3M/ · [email protected]https://security.netapp.com/advisory/ntap-20190606-0002/ · [email protected]https://usn.ubuntu.com/4004-1/ · [email protected]https://usn.ubuntu.com/4004-2/ · [email protected]https://usn.ubuntu.com/4019-1/ · [email protected]https://usn.ubuntu.com/4019-2/ · [email protected]https://www.oracle.com/security-alerts/cpuapr2020.html · [email protected]https://www.oracle.com/security-alerts/cpujan2020.html · [email protected]https://www.oracle.com/security-alerts/cpujul2020.html · [email protected]https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · [email protected]https://www.sqlite.org/releaselog/3_28_0.html · [email protected]https://www.sqlite.org/src/info/90acdbfce9c08858 · [email protected]http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00074.html · af854a3a-2127-422b-91ae-364da2661108https://kc.mcafee.com/corporate/index?page=content&id=SB10365 · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPKYSWCOM3CL66RI76TYVIG6TJ263RXH/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJPFGA45DI4F5MCF2OAACGH3HQOF4G3M/ · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20190606-0002/ · af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4004-1/ · af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4004-2/ · af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4019-1/ · af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4019-2/ · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2020.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujan2020.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujul2020.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · af854a3a-2127-422b-91ae-364da2661108https://www.sqlite.org/releaselog/3_28_0.html · af854a3a-2127-422b-91ae-364da2661108https://www.sqlite.org/src/info/90acdbfce9c08858 · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 30 MAY 15:51Z
    SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables
    cvelistv5