IM
IronMonkey Threat Research

CVE-2019-19924 MEDIUM

Published: 2019-12-24 | Last Modified: 2024-11-21 | Status: Modified

Description

SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite() error handling.

Additional Descriptions (1)

SQLite versión 3.30.1 maneja inapropiadamente cierta reescritura de árbol de análisis, relacionada con los archivos expr.c, vdbeaux.c y window.c. Esto es causado por un manejo incorrecto de errores de la función sqlite3WindowRewrite().

CVSS Metrics

Base Score: 5.3 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactLOW
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 1.4

Base Score: 5.0 (MEDIUM)

AV:N/AC:L/Au:N/C:N/I:P/A:N

Access VectorNETWORK
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactNONE
Integrity ImpactPARTIAL
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-755

Affected Products

Vendor Product Version Update Type
sqlite sqlite 3.30.1 <built-in method update of dict object at 0x7fd2d825af80> Application
siemens sinec_infrastructure_network_services * <built-in method update of dict object at 0x7fd2d8258740> Application
apache bookkeeper 4.12.1 <built-in method update of dict object at 0x7fd3081a4780> Application
oracle mysql_workbench * <built-in method update of dict object at 0x7fd341256400> Application
netapp cloud_backup - <built-in method update of dict object at 0x7fd2d825a840> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:sqlite:sqlite:3.30.1:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:apache:bookkeeper:4.12.1:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*

References