CVE-2019-19923: Null Pointer Dereference
flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results).
Other sources
SQLite is vulnerable to a denial of service, caused by a NULL pointer dereference flaw in the lattenSubquery function in select.c. By sending a specially-crafted request with the use of SELECT DISTINCT involving a LEFT JOIN, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-19923?
CVE-2019-19923 is a vulnerability in SQLite that allows a remote attacker to cause a denial of service.
How does CVE-2019-19923 impact SQLite?
CVE-2019-19923 affects SQLite by causing a NULL pointer dereference flaw in the flattenSubquery function in select.c.
What is the severity of CVE-2019-19923?
CVE-2019-19923 has a severity rating of high, with a CVSS score of 7.5.
Which software versions are affected by CVE-2019-19923?
The affected software versions of CVE-2019-19923 include IBM Data Risk Manager 2.0.6, sqlite3 3.22.0-1ubuntu0.3, and sqlite3 3.29.0-2ubuntu0.2.
How can I fix CVE-2019-19923?
To fix CVE-2019-19923, you can apply the patch provided by IBM for Data Risk Manager or update to a fixed version of sqlite3.