| Summary: | sqlite3 new security issue CVE-2022-35737 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | andrewsfarm, davidwhodgins, herman.viaene, marja11, mhrambo3501, sysadmin-bugs |
| Version: | 8 | Keywords: | advisory, has_procedure, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA8-64-OK | ||
| Source RPM: | sqlite3-3.34.1-1.2.mga8.src.rpm | CVE: | CVE-2022-35737 |
| Status comment: | |||
|
Description
David Walser
2022-07-22 16:56:30 CEST
David Walser
2022-07-22 16:56:41 CEST
Status comment:
(none) =>
Fixed upstream in 3.39.2 Assigning to all packagers collectively, since there is no registered maintainer for this package CC:
(none) =>
marja11 Updated package built for Mageia 8 Advisory: ======================== Updated sqlite3 package fixes security vulnerability: It was discovered that sqlite contained an assertion failure upon queries when compiled with -DSQLITE_ENABLE_STAT4 (CVE-2022-35737). References: https://www.sqlite.org/releaselog/3_39_2.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35737 https://sqlite.org/forum/forumpost/3607259d3c ======================== Updated packages in core/updates_testing: ======================== lemon-3.39.2-1.mga8.x86_64.rpm lib64sqlite3_0-3.39.2-1.mga8.x86_64.rpm lib64sqlite3-devel-3.39.2-1.mga8.x86_64.rpm lib64sqlite3-static-devel-3.39.2-1.mga8.x86_64.rpm sqlite3-tcl-3.39.2-1.mga8.x86_64.rpm sqlite3-tools-3.39.2-1.mga8.x86_64.rpm from sqlite3-3.39.2-1.mga8.src.rpm Possible testing procedure: https://bugs.mageia.org/show_bug.cgi?id=30384#c3 Keywords:
(none) =>
has_procedure MGA8-64 Plasma on Acer Aspire 5253 No installation issues. Did the same as in procedure suggested above: With sqlitesudio created a new database and create a new table in it with a PK, not null string, other string without rules and a timestamp column. Populated a few rows, all worked OK. CC:
(none) =>
herman.viaene
Herman Viaene
2022-07-30 14:00:17 CEST
Whiteboard:
(none) =>
MGA8-64-OK Validating. Advisory in Comment 2. CC:
(none) =>
andrewsfarm, sysadmin-bugs
Dave Hodgins
2022-08-03 00:25:26 CEST
CC:
(none) =>
davidwhodgins An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2022-0273.html Resolution:
(none) =>
FIXED Full explanation of this vulnerability: https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/ |