From 1a941a3d4cac869394125e9ee605da97196dd46e Mon Sep 17 00:00:00 2001 From: sidunder <124012191+sidunder@users.noreply.github.com> Date: Tue, 14 Feb 2023 08:38:01 -0400 Subject: [PATCH] Add sqlite advisory (#1599) Co-authored-by: sidunder --- crates/libsqlite3-sys/RUSTSEC-0000-0000.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 crates/libsqlite3-sys/RUSTSEC-0000-0000.md diff --git a/crates/libsqlite3-sys/RUSTSEC-0000-0000.md b/crates/libsqlite3-sys/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..9339cb1 --- /dev/null +++ b/crates/libsqlite3-sys/RUSTSEC-0000-0000.md @@ -0,0 +1,19 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "libsqlite3-sys" +date = "2022-08-03" +url = "https://nvd.nist.gov/vuln/detail/CVE-2022-35737" +categories = ["denial-of-service", "code-execution"] +aliases = ["CVE-2022-35737"] +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + +[versions] +patched = [">= 0.25.1"] +``` + +# `libsqlite3-sys` via C SQLite CVE-2022-35737 + +It was sometimes possible for SQLite versions >= 1.0.12, < 3.39.2 to allow an array-bounds overflow when large string were input into SQLite's `printf` function. + +As `libsqlite3-sys` bundles SQLite, it is susceptible to the vulnerability. `libsqlite3-sys` was updated to bundle the patched version of SQLite [here](https://github.com/rusqlite/rusqlite/releases/tag/sys0.25.1).