Advisory ROSA-SA-2023-2149

Software: sqlite 3.26.0
OS: ROSA Virtualization 2.1

package_evr_string: 3.26.0

CVE-ID: CVE-2019-19645
BDU-ID: None
CVE-Crit: MEDIUM
CVE-DESC: Alter.c in SQLite before 3.30.1 allows attackers to trigger infinite recursion using certain types of self-referential views in conjunction with ALTER TABLE statements.
CVE-STATUS: Fixed
CVE-REV: Run the yum update sqlite command to close it

CVE-ID: CVE-2019-19880
BDU-ID: None
CVE-Crit: HIGH
CVE-DESC: ExprListAppendList in window.c in SQLite 3.30.1 allows attackers to initiate invalid pointer dereferencing due to improper handling of constant integer values in ORDER BY sentences of window definitions.
CVE-STATUS: Fixed
CVE-REV: Execute the yum update sqlite command to close it

CVE-ID: CVE-2020-35525
BDU-ID: None
CVE-Crit: HIGH
CVE-DESC: In SQlite 3.31.1, a potential null pointer dereference was detected while processing an INTERSEC request.
CVE-STATUS: Fixed
CVE-REV: Execute the yum update sqlite command to close it

CVE-ID: CVE-2020-35527
BDU-ID: None
CVE-Crit: CRITICAL
CVE-DESC: In SQLite 3.31.1, there is an issue with out-of-bounds access via ALTER TABLE for views that have a nested FROM clause.
CVE-STATUS: Fixed
CVE-REV: Run the yum update sqlite command to close it

CVE-ID: CVE-2022-35737
BDU-ID: None
CVE-Crit: HIGH
CVE-DESC: SQLite from 1.0.12 to 3.39.x to 3.39.2 sometimes allows array boundary overflow if billions of bytes are used in a C API string argument.
CVE-STATUS: Fixed
CVE-REV: Run the yum update sqlite command to close it