Source: sqlite3 Version: 3.40.0-1 Severity: important Tags: security upstream Forwarded: https://sqlite.org/forum/forumpost/07beac8056151b2f X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org>
Hi, The following vulnerability was published for sqlite3. CVE-2022-46908[0]: | SQLite through 3.40.0, when relying on --safe for execution of an | untrusted CLI script, does not properly implement the | azProhibitedFunctions protection mechanism, and instead allows UDF | functions such as WRITEFILE. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2022-46908 https://www.cve.org/CVERecord?id=CVE-2022-46908 [1] https://sqlite.org/forum/forumpost/07beac8056151b2f [2] https://sqlite.org/src/info/cefc032473ac5ad2 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
