Input validation error in SQLite - CVE-2020-11655

Vulnerability identifier: #VU27023

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-11655

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when the AggInfo object's initialization is mishandled. A remote attacker can pass specially crafted input via a malformed window-function query to the application and perform a denial of service (DoS) attack.

SQLite
ONTAP Select Deploy administration utility
VMware Horizon Client
Gentoo Linux
FreeBSD
Junos OS
Junos OS Evolved
busybox (Alpine package)
sqlite (Alpine package)
firefox-esr (Alpine package)
Telemetry Dashboard
Liquidware
Citrix Workspace App
Webex App VDI
Tenable.sc
PowerScale OneFS
Cisco Jabber
Cisco Webex Meetings
SINEC INS
IBM QRadar Data Synchronization App

Install update from vendor's website.

SQLite - update to 3.32.0
Telemetry Dashboard - update to 1.1.0.6 on Thin OS 2405
sqlite (Alpine package) - update to 3.25.3-r4
Tenable.sc - update to 5.19.0
Liquidware - update to 6.7.0.2.2 on Thin OS 2405
Cisco Jabber - update to 14.3.0.308378.11 on Thin OS 2405
Junos OS - addressed in versions 19.3R3-S6, 19.4R2-S6, 19.4R3-S8, 20.1R3-S4, 20.2R3-S4, 20.3R3-S3
Junos OS Evolved - addressed in versions 21.2R3-EVO, 21.3R3-EVO, 21.4R2-EVO, 22.1R1-EVO
Citrix Workspace App - update to 24.2.0.65.17 on Thin OS 2405
Webex App VDI - update to 44.2.0.28744.1 on Thin OS 2405
Cisco Webex Meetings - update to 44.2.0.76.2 on Thin OS 2405
VMware Horizon Client - update to 2312.1.8.12.1.5 on Thin OS 2405
SINEC INS - update to 1.0.1.1
IBM QRadar Data Synchronization App - update to 3.0.1

• https://security.netapp.com/advisory/ntap-20200416-0001/
• https://www3.sqlite.org/cgi/src/info/4a302b42c7bf5e11
• https://www3.sqlite.org/cgi/src/tktview?name=af4556bb5c

• Multiple vulnerabilities in SQLite
• Multiple vulnerabilities in NetApp ONTAP Select Deploy administration utility
• FreeBSD update for SQLite
• Input validation error in sqlite (Alpine package)
• Input validation error in busybox (Alpine package)
• Gentoo update for SQLite
• Input validation error in firefox-esr (Alpine package)
• Multiple vulnerabilities in Tenable.sc
• Multiple vulnerabilities in Siemens SINEC INS
• Multiple vulnerabilities in IBM QRadar Data Synchronization App
• Juniper Junos OS and Junos OS Evolved update for SQLite
• Multiple vulnerabilities in Dell EMC PowerScale OneFS
• Multiple vulnerabilities in Dell ThinOS