Input validation error in SQLite - CVE-2019-19244

Vulnerability identifier: #VU23190

CSH Severity: Low

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-19244

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage in select.c . A remote attacker can crash the affected application using a specially crafted SQL query.

SQLite
DataMosaix Private Cloud
Netezza Appliance
sqlite (Alpine package)
sqlite3 (Ubuntu package)
libsqlite3-0-debuginfo
libsqlite3-0-32bit-debuginfo
libsqlite3-0-32bit
sqlite3-devel
sqlite3-debugsource
libsqlite3-0
sqlite3-debuginfo
sqlite3
libsqlite3-0-debuginfo-32bit
EMC Integrated Data Protection Appliance
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server
SUSE CaaS Platform
SUSE MicroOS
SUSE Enterprise Storage
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
Dell EMC Data Protection Search
SINEC INS
Dell EMC Container Storage Modules
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity XT Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC VxRail Appliance

Install update from vendor's website.

SQLite - update to 3.31.0
DataMosaix Private Cloud - update to 7.09
Netezza Appliance - update to 1.0.0.1
EMC Integrated Data Protection Appliance - update to 2.7.1
sqlite3 (Ubuntu package) - addressed in versions 3.11.0-1ubuntu1.3, 3.22.0-1ubuntu0.2, 3.27.2-2ubuntu0.2, 3.29.0-2ubuntu0.1
sqlite (Alpine package) - update to 3.25.3-r3
Dell EMC Data Protection Search - update to 19.6.0
SINEC INS - update to 1.0.1.1
Dell EMC Container Storage Modules - update to 1.7.0
libsqlite3-0-debuginfo - addressed in versions 3.36.0-3.12.1, 3.36.0-9.18.1
libsqlite3-0-32bit-debuginfo - update to 3.36.0-3.12.1
libsqlite3-0-32bit - addressed in versions 3.36.0-3.12.1, 3.36.0-9.18.1
sqlite3-devel - addressed in versions 3.36.0-3.12.1, 3.36.0-9.18.1
sqlite3-debugsource - addressed in versions 3.36.0-3.12.1, 3.36.0-9.18.1
libsqlite3-0 - addressed in versions 3.36.0-3.12.1, 3.36.0-9.18.1
sqlite3-debuginfo - addressed in versions 3.36.0-3.12.1, 3.36.0-9.18.1
sqlite3 - addressed in versions 3.36.0-3.12.1, 3.36.0-9.18.1
libsqlite3-0-debuginfo-32bit - update to 3.36.0-9.18.1
Dell EMC Unity Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC Unity XT Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC Unity VSA Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC VxRail Appliance - update to 7.0.203

• https://github.com/sqlite/sqlite/commit/e59c562b3f6894f84c715772c4b116d7b5c01348

• Multiple vulnerabilities in SQLite
• Ubuntu update for SQLite
• Input validation error in sqlite (Alpine package)
• Multiple vulnerabilities in Siemens SINEC INS
• Multiple vulnerabilities in Dell EMC Integrated Data Protection Appliance
• Multiple vulnerabilities in Dell EMC Data Protection Search
• SUSE update for sqlite3
• SUSE update for sqlite3
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Multiple vulnerabilities in Dell Unity, Dell UnityVSA, and Dell Unity XT
• Multiple vulnerabilities in Dell Container Storage Modules
• Multiple vulnerabilities in Rockwell Automation DataMosaix Private Cloud
• Multiple vulnerabilities in IBM Netezza Appliance