{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-46908", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-03T14:47:27.711Z", "dateReserved": "2022-12-12T00:00:00", "datePublished": "2022-12-12T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-11-24T14:06:18.728890"}, "descriptions": [{"lang": "en", "value": "SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://news.ycombinator.com/item?id=33948588"}, {"url": "https://sqlite.org/forum/forumpost/07beac8056151b2f"}, {"url": "https://sqlite.org/src/info/cefc032473ac5ad2"}, {"url": "https://security.netapp.com/advisory/ntap-20230203-0005/"}, {"name": "GLSA-202311-03", "tags": ["vendor-advisory"], "url": "https://security.gentoo.org/glsa/202311-03"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T14:47:27.711Z"}, "title": "CVE Program Container", "references": [{"url": "https://news.ycombinator.com/item?id=33948588", "tags": ["x_transferred"]}, {"url": "https://sqlite.org/forum/forumpost/07beac8056151b2f", "tags": ["x_transferred"]}, {"url": "https://sqlite.org/src/info/cefc032473ac5ad2", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20230203-0005/", "tags": ["x_transferred"]}, {"name": "GLSA-202311-03", "tags": ["vendor-advisory", "x_transferred"], "url": "https://security.gentoo.org/glsa/202311-03"}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*", "matchCriteriaId": "B163FB3C-EDA0-4A12-9617-9593654FB0D4", "versionEndExcluding": "3.40.1", "versionStartIncluding": "3.37.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE."}, {"lang": "es", "value": "SQLite hasta 3.40.0, cuando depende de --safe para la ejecuci\u00f3n de un script CLI que no es de confianza, no implementa correctamente el mecanismo de protecci\u00f3n azProhibitedFunctions y, en su lugar, permite funciones UDF como WRITEFILE."}], "id": "CVE-2022-46908", "lastModified": "2023-11-24T14:15:08.220", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.5, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-12-12T06:15:10.793", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://news.ycombinator.com/item?id=33948588"}, {"source": "cve@mitre.org", "url": "https://security.gentoo.org/glsa/202311-03"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20230203-0005/"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://sqlite.org/forum/forumpost/07beac8056151b2f"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://sqlite.org/src/info/cefc032473ac5ad2"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "sqlite: safe mode authorizer callback allows disallowed UDFs", "id": "2152844", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2152844"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "status": "draft"}, "cwe": "CWE-89", "details": ["SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.", "A flaw was found in the SQLite package. SQLite could allow a local attacker to bypass security restrictions caused by an issue when relying on --safe for the execution of an untrusted CLI script, potentially leading to arbitrary file read/write."], "name": "CVE-2022-46908", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "sqlite", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "sqlite", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "sqlite", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "sqlite", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2022-12-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-46908\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-46908"], "threat_severity": "Moderate"}