Vulnerability · Published Aug 3, 2022 · Assigned by mitre
CVE-2022-35737
High 7.5
In plain English
A high-severity security flaw in the lemon package (AlmaLinux). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 23.6% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)23.6%top 2.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC
Official description
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | lemon | 3.26.0-17.el8_7 | ALSA-2023:0110 |
| AlmaLinux:8 | sqlite | 3.26.0-17.el8_7 | ALSA-2023:0110 |
| AlmaLinux:9 | sqlite | 3.34.1-6.el9_1 | ALSA-2023:0339 |
| AlmaLinux:8 | sqlite-devel | 3.26.0-17.el8_7 | ALSA-2023:0110 |
| AlmaLinux:9 | sqlite-devel | 3.34.1-6.el9_1 | ALSA-2023:0339 |
| AlmaLinux:8 | sqlite-doc | 3.26.0-17.el8_7 | ALSA-2023:0110 |
| AlmaLinux:8 | sqlite-libs | 3.26.0-17.el8_7 | ALSA-2023:0110 |
| AlmaLinux:9 | sqlite-libs | 3.34.1-6.el9_1 | ALSA-2023:0339 |
| Alpine:v3.20 | qt5-qtwebengine | 5.15.11-r3 | ALPINE-CVE-2022-35737 |
| Alpine:v3.21 | qt5-qtwebengine | 5.15.11-r3 | ALPINE-CVE-2022-35737 |
| Alpine:v3.22 | qt5-qtwebengine | 5.15.11-r3 | ALPINE-CVE-2022-35737 |
| Alpine:v3.23 | qt5-qtwebengine | 5.15.11-r3 | ALPINE-CVE-2022-35737 |
| Debian:12 | sqlite3 | 3.39.2-1 | DEBIAN-CVE-2022-35737 |
| Debian:13 | sqlite3 | 3.39.2-1 | DEBIAN-CVE-2022-35737 |
| Debian:14 | sqlite3 | 3.39.2-1 | DEBIAN-CVE-2022-35737 |
| Rocky Linux:8 | sqlite | 0:3.26.0-17.el8_7 | RLSA-2023:0110 |
| Rocky Linux:9 | sqlite | 0:3.34.1-6.el9_1 | RLSA-2023:0339 |
| Ubuntu:22.04:LTS | sqlite3 | 3.37.2-2ubuntu0.1 | USN-5716-1 |
| Ubuntu:22.04:LTS | sqlite3 | 3.37.2-2ubuntu0.1 | UBUNTU-CVE-2022-35737 |
Affected products (as reported)
References
- https://www.sqlite.org/cves.html
- https://kb.cert.org/vuls/id/720344
- https://sqlite.org/releaselog/3_39_2.html
- https://security.netapp.com/advisory/ntap-20220915-0009/
- https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/
- GLSA-202210-40 vendor-advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html