Reported

August 3, 2022

Issued

February 14, 2023 (last modified: June 13, 2023)

Package

libsqlite3-sys (crates.io)

Type

Vulnerability

Categories

• denial-of-service
• code-execution

Aliases

• CVE-2022-35737
• GHSA-jw36-hf63-69r9

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-35737

CVSS Score

7.5 HIGH

CVSS Details

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality Impact

None

Integrity Impact

None

Availability Impact

High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Patched

• >=0.25.1

Description

It was sometimes possible for SQLite versions >= 1.0.12, < 3.39.2 to allow an array-bounds overflow when large string were input into SQLite's printf function.

As libsqlite3-sys bundles SQLite, it is susceptible to the vulnerability. libsqlite3-sys was updated to bundle the patched version of SQLite here.

Advisory available under CC0-1.0 license.