Critical · published April 9, 2020
⚠️ A sneaky use-after-free in SQLite could turn your table tidy into a bit of a mess! Think of it like a restaurant that tries to serve an order after the chef has already cleared the kitchen — the tables might not be set right, leading to all sorts of confusion for the diners. This vulnerability in ALTER TABLE is like letting customers sit down at a table that’s just been reconfigured, but with old data still lingering around. An attacker with the means to exploit this vulnerability could potentially manipulate the database's behavior, leading to unexpected results or crashes. While it’s not a full-blown disaster, it could create data integrity issues that are absolutely devastating for any application relying on SQLite.
Think of it like a restaurant that tries to serve an order after the chef has already cleared the kitchen — the tables might not be set right, leading to all sorts of confusion for the diners. This vulnerability in ALTER TABLE is like letting customers sit down at a table that’s just been reconfigured, but with old data still lingering around. In SQLite versions up to 3.31.1, the ALTER TABLE command has a use-after-free flaw that can be triggered by an ORDER BY clause in a compound SELECT statement. This can allow for unpredictable behavior during database operations.
An attacker with the means to exploit this vulnerability could potentially manipulate the database's behavior, leading to unexpected results or crashes. While it’s not a full-blown disaster, it could create data integrity issues that are absolutely devastating for any application relying on SQLite. Upgrade your SQLite to version 3.31.2 or later to patch this issue. Regularly audit your database operations, specifically any use of ALTER TABLE, to ensure proper handling of data and avoid unexpected behavior. You've got this! By updating your SQLite version, you’ll keep your database sailing smoothly! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| sqlite/sqlite | ≤ 3.31.1 | — |
| netapp/ontap_select_deploy_administration_utility | all versions | — |
| oracle/communications_network_charging_and_control | ≥ 12.0.0, ≤ 12.0.3 | — |
| oracle/communications_network_charging_and_control | all versions | — |
| oracle/communications_network_charging_and_control | all versions | — |
| oracle/enterprise_manager_ops_center | all versions | — |
| oracle/hyperion_infrastructure_technology | all versions | — |
| oracle/mysql | ≥ 8.0.0, ≤ 8.0.22 | — |
| oracle/mysql_workbench | ≤ 8.0.22 | — |
| oracle/outside_in_technology | all versions | — |
| oracle/outside_in_technology | all versions | — |
| oracle/zfs_storage_appliance_kit | all versions | — |
| oracle/communications_messaging_server | all versions | — |
| siemens/sinec_infrastructure_network_services | < 1.0.1.1 | 1.0.1.1 |
| tenable/tenable.sc | ≤ 5.19.0 | — |