SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions su…
High CVSS 7.3
Summary
SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://news.ycombinator.com/item?id=33948588 Exploit
- https://security.gentoo.org/glsa/202311-03
- https://security.netapp.com/advisory/ntap-20230203-0005/ Third Party Advisory
- https://sqlite.org/forum/forumpost/07beac8056151b2f Exploit
- https://sqlite.org/src/info/cefc032473ac5ad2 Patch
- https://news.ycombinator.com/item?id=33948588 Exploit
- https://security.gentoo.org/glsa/202311-03
- https://security.netapp.com/advisory/ntap-20230203-0005/ Third Party Advisory
- https://sqlite.org/forum/forumpost/07beac8056151b2f Exploit
- https://sqlite.org/src/info/cefc032473ac5ad2 Patch
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-556635.html
Timeline
- nvd_ingest NVD