CVE-2022-46908

CVE-2022-46908

High · published December 12, 2022

CVSS v3.1
7.3
EPSS
0%
Percentile
37.7
In the wild
Unconfirmed
What it is

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00446 · 37.7th percentile
Published
2022-12-12T11:15Z
Affected products (1)
ProductVersionsFixed in
sqlite/sqlite≥ 3.37.0, < 3.40.13.40.1
References (12)
https://news.ycombinator.com/item?id=33948588 · [email protected]https://security.gentoo.org/glsa/202311-03 · [email protected]https://security.netapp.com/advisory/ntap-20230203-0005/ · [email protected]https://sqlite.org/forum/forumpost/07beac8056151b2f · [email protected]https://sqlite.org/src/info/cefc032473ac5ad2 · [email protected]https://news.ycombinator.com/item?id=33948588 · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202311-03 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20230203-0005/ · af854a3a-2127-422b-91ae-364da2661108https://sqlite.org/forum/forumpost/07beac8056151b2f · af854a3a-2127-422b-91ae-364da2661108https://sqlite.org/src/info/cefc032473ac5ad2 · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-556635.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 12 DEC 00:00Z
    SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection…
    cvelistv5