Bug 25801 - sqlite3 new security issues CVE-2019-5018, CVE-2019-16168, CVE-2019-1924[24]
Summary: sqlite3 new security issues CVE-2019-5018, CVE-2019-16168, CVE-2019-1924[24]
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: David GEIGER
QA Contact: Sec team
URL:
Whiteboard:
Keywords:
Depends on: 26104
Blocks:
  Show dependency tree / graph
 
Reported: 2019-12-03 18:24 CET by David Walser
Modified: 2020-01-30 23:14 CET (History)
0 users

See Also:
Source RPM: sqlite3-3.30.1-2.mga8.src.rpm
CVE:
Status comment: Patches available from Ubuntu

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2019-12-03 18:24:39 CET 
Ubuntu has issued an advisory on December 2:
https://usn.ubuntu.com/4205-1/

Mageia 7 is also affected.
David Walser 2019-12-03 18:24:48 CET

Whiteboard: (none) => MGA7TOO

Comment 1 Lewis Smith 2019-12-03 19:10:43 CET 
In the absence of an active registered maintainer, assigning to the actual active maintainer.

Assignee: bugsquad => geiger.david68210

Comment 2 David Walser 2019-12-19 21:49:42 CET 
CVE-2019-5827 was fixed in 3.28.0 (already in Mageia 7), removing from this bug:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/EXD2GYJVTDGEQPUNMMMC5TB7MQXOBBMO/
https://bugzilla.redhat.com/show_bug.cgi?id=1706805
https://sqlite.org/chronology.html

Summary: sqlite3 new security issues CVE-2019-5018, CVE-2019-5827, CVE-2019-16168, CVE-2019-1924[24] => sqlite3 new security issues CVE-2019-5018, CVE-2019-16168, CVE-2019-1924[24]

David Walser 2020-01-14 17:55:49 CET

Status comment: (none) => Patches available from Ubuntu

David Walser 2020-01-18 20:27:34 CET

Depends on: (none) => 26104

Comment 3 David Walser 2020-01-25 12:53:27 CET 
CVE-2019-5018 fix was already in 3.28.0.

CVE-2019-16168 and CVE-2019-1924[24] are fixed in the 3.31.0 update.

Version: Cauldron => 7
Whiteboard: MGA7TOO => (none)

Comment 4 David Walser 2020-01-30 23:14:04 CET 
Fixed in:
https://advisories.mageia.org/MGASA-2020-0070.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.