Bug 34217 - sqlite3 new security issue CVE-2025-29088
Summary: sqlite3 new security issue CVE-2025-29088
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2025-04-22 14:15 CEST by Nicolas Salguero
Modified: 2025-05-27 20:47 CEST (History)
3 users (show)

See Also:
Source RPM: sqlite3-3.40.1-1.1.mga9.src.rpm
CVE: CVE-2025-29088
Status comment:


Attachments

Description Nicolas Salguero 2025-04-22 14:15:25 CEST
openSUSE has issued an advisory on April 15:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/DUNGXGTRJGRYS2XF6QS2CZPSWAF5HHVJ/

Cauldron already has version 3.49.1 and Mageia 9 is only affected by CVE-2025-29088.
Comment 1 Nicolas Salguero 2025-04-22 14:16:27 CEST
Upstream fix: https://github.com/sqlite/sqlite/commit/56d2fd008b108109f489339f5fd55212bb50afd4

Source RPM: (none) => sqlite3-3.40.1-1.1.mga9.src.rpm
Status comment: (none) => Patch available from upstream
CVE: (none) => CVE-2025-29088

Comment 2 Lewis Smith 2025-04-23 11:10:46 CEST
Thanks for the patch ref.
Unsure where to push this, so assigning it globally.

Assignee: bugsquad => pkg-bugs

Comment 3 Nicolas Salguero 2025-05-23 14:37:15 CEST
Suggested advisory:
========================

The updated packages fix a security vulnerability:

In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect. (CVE-2025-29088)

References:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/DUNGXGTRJGRYS2XF6QS2CZPSWAF5HHVJ/
========================

Updated packages in core/updates_testing:
========================
lemon-3.40.1-1.2.mga9
lib(64)sqlite3_0-3.40.1-1.2.mga9
lib(64)sqlite3-devel-3.40.1-1.2.mga9
lib(64)sqlite3-static-devel-3.40.1-1.2.mga9
sqlite3-tcl-3.40.1-1.2.mga9
sqlite3-tools-3.40.1-1.2.mga9

from SRPM:
sqlite3-3.40.1-1.2.mga9.src.rpm

Status: NEW => ASSIGNED
Assignee: pkg-bugs => qa-bugs
Status comment: Patch available from upstream => (none)

katnatek 2025-05-23 19:09:07 CEST

Keywords: (none) => advisory

Comment 4 Herman Viaene 2025-05-25 10:47:59 CEST
MGA9-64 Plasma Wayland on Compaq H000SB.
No installation issues.
Ref bug 30660 for testing:
With sqlitesudio created a new database and create a new table in it with a PK, not null string, other string without rules and a timestamp column. Populated a few rows, all worked OK.
OK, except for one thing I didn't see on previous updates - overlooked???
The timestamp column does not show its value unless I close sqlitesudio and reopen it.
But this seems to be a quack in sqlitesudio, since the insert command on sqlite3-CLI shows the timestamp immediately in a select command.
So good to go.

Whiteboard: (none) => MGA9-64-OK
CC: (none) => herman.viaene

Comment 5 Thomas Andrews 2025-05-27 03:00:31 CEST
Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Comment 6 Mageia Robot 2025-05-27 20:47:26 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0167.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.