CVE-2022-46908
published 2022-12-12CVE-2022-46908: SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection…
PriorityP337high7.3CVSS 3.1
AVLACLPRLUINSUCHIHAL
EPSS
0.43%
34.5th percentile
SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | sqlite3 | < sqlite3 3.40.0-2 (bookworm) | sqlite3 3.40.0-2 (bookworm) |
| ghost | sqlite3 | >= 0 < 3.40.0-2 | 3.40.0-2 |
| ghost | sqlite3 | >= 0 < 3.40.0-2 | 3.40.0-2 |
| ghost | sqlite3 | >= 0 < 3.40.0-2 | 3.40.0-2 |
| ghost | sqlite3 | >= 0 < 3.31.1-4ubuntu0.6 | 3.31.1-4ubuntu0.6 |
| ghost | sqlite3 | >= 0 < 3.37.2-2ubuntu0.3 | 3.37.2-2ubuntu0.3 |
| msrc | cbl2_sqlite_3.39.2-2_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_sqlite_3.34.1-2_on_cbl_mariner_1.0 | — | — |
| sqlite | sqlite | >= 3.37.0 < 3.40.1 | 3.40.1 |
CVSS provenance
nvdv3.17.3HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
osv7.3HIGH
vendor_debian7.3HIGH
vendor_msrc7.3HIGH
vendor_oracle7.3HIGH
vendor_redhat7.3HIGH
vendor_ubuntu7.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens Telecontrol Server Basic
cisa_ics·2024-04-11
Siemens Telecontrol Server Basic
ICS Advisory
##
Siemens Telecontrol Server Basic
Release DateApril 11, 2024
Alert CodeICSA-24-102-08
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: Telecontrol Server Basic
- Vulnerabilities: Inadequate Encryption Strength, Double Free, Integer Overflow or Wraparound, External Control of File Name or Path, Path Traversal, Improper Input Validation, Missing Encry
Oracle
Oracle Oracle MySQL Risk Matrix: MySQL Workbench (SQLite) — CVE-2022-46908
vendor_oracle·2024-01-15·CVSS 7.3
CVE-2022-46908 [HIGH] Oracle Oracle MySQL Risk Matrix: MySQL Workbench (SQLite) — CVE-2022-46908
Oracle Oracle MySQL Risk Matrix: MySQL Workbench (SQLite) vulnerability
CVE: CVE-2022-46908
CVSS: 7.3
Protocol: MySQL Workbench
Remote exploit: No
Affected versions: Local
Advisory: cpujan2024 (JAN 2024)
Ubuntu
SQLite vulnerabilities
vendor_ubuntu·2024-01-03·CVSS 7.3
CVE-2022-46908 [HIGH] SQLite vulnerabilities
Title: SQLite vulnerabilities
Summary: Several security issues were fixed in SQLite.
It was discovered that SQLite incorrectly handled certain protection
mechanisms when using a CLI script with the --safe option, contrary to
expectations. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-46908)
It was discovered that SQLite incorrectly handled certain memory operations
in the sessions extension. A remote attacker could possibly use this issue
to cause SQLite to crash, resulting in a denial of service. (CVE-2023-7104)
Instructions: In general, a standard system update will make all the necessary changes.
Oracle
Oracle Oracle Communications Applications Risk Matrix: Common fns (SQLite) — CVE-2022-46908
vendor_oracle·2023-04-15·CVSS 7.3
CVE-2022-46908 [HIGH] Oracle Oracle Communications Applications Risk Matrix: Common fns (SQLite) — CVE-2022-46908
Oracle Oracle Communications Applications Risk Matrix: Common fns (SQLite) vulnerability
CVE: CVE-2022-46908
CVSS: 7.3
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpuapr2023 (APR 2023)
Microsoft
SQLite through 3.40.0 when relying on --safe for execution of an untrusted CLI script does not properly implement the azProhibitedFunctions protection mechanism and instead allows UDF functions such a
vendor_msrc·2022-12-13·CVSS 7.3
CVE-2022-46908 [HIGH] SQLite through 3.40.0 when relying on --safe for execution of an untrusted CLI script does not properly implement the azProhibitedFunctions protection mechanism and instead allows UDF functions such a
SQLite through 3.40.0 when relying on --safe for execution of an untrusted CLI script does not properly implement the azProhibitedFunctions protection mechanism and instead allows UDF functions such as WRITEFILE.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we wil
Red Hat
sqlite: safe mode authorizer callback allows disallowed UDFs
vendor_redhat·2022-12-12·CVSS 7.3
CVE-2022-46908 [HIGH] CWE-89 sqlite: safe mode authorizer callback allows disallowed UDFs
sqlite: safe mode authorizer callback allows disallowed UDFs
SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.
A flaw was found in the SQLite package. SQLite could allow a local attacker to bypass security restrictions caused by an issue when relying on --safe for the execution of an untrusted CLI script, potentially leading to arbitrary file read/write.
Package: sqlite (Red Hat Enterprise Linux 6) - Not affected
Package: sqlite (Red Hat Enterprise Linux 7) - Not affected
Package: sqlite (Red Hat Enterprise Linux 8) - Not affected
Package: sqlite (Red Hat Enterprise Linux 9) - Not affected
Debian
CVE-2022-46908: sqlite3 - SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI ...
vendor_debian·2022·CVSS 7.3
CVE-2022-46908 [HIGH] CVE-2022-46908: sqlite3 - SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI ...
SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.
Scope: local
bookworm: resolved (fixed in 3.40.0-2)
bullseye: resolved
forky: resolved (fixed in 3.40.0-2)
sid: resolved (fixed in 3.40.0-2)
trixie: resolved (fixed in 3.40.0-2)
OSV
sqlite3 vulnerabilities
osv·2024-01-03·CVSS 7.3
CVE-2022-46908 [HIGH] sqlite3 vulnerabilities
sqlite3 vulnerabilities
It was discovered that SQLite incorrectly handled certain protection
mechanisms when using a CLI script with the --safe option, contrary to
expectations. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-46908)
It was discovered that SQLite incorrectly handled certain memory operations
in the sessions extension. A remote attacker could possibly use this issue
to cause SQLite to crash, resulting in a denial of service. (CVE-2023-7104)
GHSA
GHSA-993x-6558-2xmj: SQLite through 3
ghsa_unreviewed·2022-12-12
CVE-2022-46908 [CRITICAL] GHSA-993x-6558-2xmj: SQLite through 3
SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.
OSV
CVE-2022-46908: SQLite through 3
osv·2022-12-12·CVSS 7.3
CVE-2022-46908 [HIGH] CVE-2022-46908: SQLite through 3
SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.
No detection rules found.
No public exploits indexed.
Trailofbits
Celebrating our 2023 open-source contributions
blogs_trailofbits·2024-01-24
Celebrating our 2023 open-source contributions
At Trail of Bits, we pride ourselves on making our best tools open source, such as Slither, PolyTracker, and RPC Investigator. But while this post is about open source, it’s not about our tools…
In 2023, our employees submitted over 450 pull requests (PRs) that were merged into non-Trail of Bits repositories. This demonstrates our commitment to securing the software ecosystem as a whole and to improving software quality for everyone. A representative list of contributions appears at the end of this post, but here are some highlights:
- Sigstore-conformance, a vital component of our Sigstore initiative in open-source engineering, functions as an integration test suite for diverse Sigstore client implementations. Ensuring conformity to the Sigstore client testing suite, it rigorously evalu
Trailofbits
Celebrating our 2023 open-source contributions
blogs_trailofbits·2024-01-24
Celebrating our 2023 open-source contributions
At Trail of Bits, we pride ourselves on making our best tools open source, such as Slither , PolyTracker , and RPC Investigator . But while this post is about open source, it’s not about our tools…
In 2023, our employees submitted over 450 pull requests (PRs) that were merged into non-Trail of Bits repositories. This demonstrates our commitment to securing the software ecosystem as a whole and to improving software quality for everyone. A representative list of contributions appears at the end of this post, but here are some highlights:
Sigstore-conformance , a vital component of our Sigstore initiative in open-source engineering, functions as an integration test suite for diverse Sigstore client implementations. Ensuring conformity to the Sigstore client testing suite, it rigorously eva
https://news.ycombinator.com/item?id=33948588https://security.gentoo.org/glsa/202311-03https://security.netapp.com/advisory/ntap-20230203-0005/https://sqlite.org/forum/forumpost/07beac8056151b2fhttps://sqlite.org/src/info/cefc032473ac5ad2https://news.ycombinator.com/item?id=33948588https://security.gentoo.org/glsa/202311-03https://security.netapp.com/advisory/ntap-20230203-0005/https://sqlite.org/forum/forumpost/07beac8056151b2fhttps://sqlite.org/src/info/cefc032473ac5ad2
2022-12-12
Published