Vulnerability · Published May 1, 2022 · Assigned by snyk
CVE-2022-21227Denial of Service (DoS)
High 7.5
In plain English
A high-severity security flaw in sqlite3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)2.2%top 17.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The package sqlite3 before 5.0.3 are vulnerable to Denial of Service (DoS) which will invoke the toString function of the passed parameter. If passed an invalid Function object it will throw and crash the V8 engine.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-sqlite3 | 5.0.6+ds1-1 | DEBIAN-CVE-2022-21227 |
| Debian:13 | node-sqlite3 | 5.0.6+ds1-1 | DEBIAN-CVE-2022-21227 |
| Debian:14 | node-sqlite3 | 5.0.6+ds1-1 | DEBIAN-CVE-2022-21227 |
| Ubuntu:22.04:LTS | node-sqlite3 | no fix listed | UBUNTU-CVE-2022-21227 |
| npm | sqlite3 | 5.0.3 | GHSA-9qrh-qjmc-5w2p |
Affected products (as reported)
References
- https://snyk.io/vuln/SNYK-JS-SQLITE3-2388645 x_refsource_MISC
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2805470 x_refsource_MISC
- https://github.com/TryGhost/node-sqlite3/commit/593c9d498be2510d286349134537e3bf89401c4a x_refsource_MISC