CVE Vulnerabilities

CVE-2022-46908

Published: Dec 12, 2022 | Modified: May 05, 2025
CVSS 3.x
7.3
HIGH
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CVSS 2.x
RedHat/V2
RedHat/V3
7.3 MODERATE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Ubuntu
LOW
root.io minimus.io echohq.com

SQLite through 3.40.0, when relying on –safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.

Affected Software

Name Vendor Start Version End Version
Sqlite Sqlite 3.37.0 (including) 3.40.1 (excluding)
Sqlite3 Ubuntu jammy *
Sqlite3 Ubuntu kinetic *
Sqlite3 Ubuntu upstream *

References