CVE-2019-19924: SQL Injection
Last updated 25 August 2025
Other sources
SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite() error handling.
— Launchpad
SQLite is vulnerable to a denial of service, caused by the mishandling of certain parser-tree rewriting in the sqlite3WindowRewrite function in expr.c, vdbeaux.c, and window.c. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-19924?
CVE-2019-19924 is a vulnerability in SQLite that allows a remote attacker to cause a denial of service.
How does CVE-2019-19924 impact SQLite?
CVE-2019-19924 affects the sqlite3WindowRewrite function in SQLite, which can be exploited to cause a denial of service.
What is the severity of CVE-2019-19924?
CVE-2019-19924 has a severity rating of 5.3 (medium).
How can I fix CVE-2019-19924 in IBM Data Risk Manager?
To fix CVE-2019-19924 in IBM Data Risk Manager, update to version 2.0.6 or apply the patch provided by IBM.
How can I fix CVE-2019-19924 in Ubuntu and Debian?
To fix CVE-2019-19924 in Ubuntu, update the sqlite3 package to version 3.29.0-2ubuntu0.2 or 3.30.1+, and in Debian, update the sqlite or sqlite3 package to the recommended versions.