CVE-2019-19923: Null Pointer Dereference
flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results).
Other sources
SQLite is vulnerable to a denial of service, caused by a NULL pointer dereference flaw in the lattenSubquery function in select.c. By sending a specially-crafted request with the use of SELECT DISTINCT involving a LEFT JOIN, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 120.0.6099.224-1~deb11u1Fixed in 150.0.7871.100-1~deb12u1Fixed in 150.0.7871.124-1~deb12u1Fixed in 150.0.7871.100-1~deb13u1Fixed in 150.0.7871.114-1~deb13u1Fixed in 150.0.7871.114-1Fixed in 150.0.7871.124-1 - Upgrade
Upgrade
debian/sqlite3to a version that resolves this vulnerability.Fixed in 3.34.1-3Fixed in 3.34.1-3+deb11u1Fixed in 3.40.1-2+deb12u2Fixed in 3.46.1-7+deb13u1Fixed in 3.46.1-9Fixed in 3.53.3-1 - Upgrade
Upgrade
sqlite/sqliteto a version that resolves this vulnerability.Fixed in 3.30.1Patch 396afe6f6aa90a31303c183e11b2b2d4b7956b35 - Compensating control
Mitigate the denial-of-service risk by preventing remote attackers from being able to send specially-crafted requests that trigger the SQLite NULL pointer dereference in lattenSubquery/SELECT DISTINCT + LEFT JOIN processing (e.g., restrict/limit access to the endpoint that performs queries).
Event History
Frequently Asked Questions
What is CVE-2019-19923?
CVE-2019-19923 is a vulnerability in SQLite that allows a remote attacker to cause a denial of service.
How does CVE-2019-19923 impact SQLite?
CVE-2019-19923 affects SQLite by causing a NULL pointer dereference flaw in the flattenSubquery function in select.c.
What is the severity of CVE-2019-19923?
CVE-2019-19923 has a severity rating of high, with a CVSS score of 7.5.
Which software versions are affected by CVE-2019-19923?
The affected software versions of CVE-2019-19923 include IBM Data Risk Manager 2.0.6, sqlite3 3.22.0-1ubuntu0.3, and sqlite3 3.29.0-2ubuntu0.2.
How can I fix CVE-2019-19923?
To fix CVE-2019-19923, you can apply the patch provided by IBM for Data Risk Manager or update to a fixed version of sqlite3.