CVE-2023-32697

EUVD-2023-1486
SQLite JDBC is a library for accessing and creating SQLite database files in Java. Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL. This issue impacting versions 3.6.14.1 through 3.41.2.1 and has been fixed in version 3.41.2.2.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub_MCNA
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 89%
Affected Products (NVD)
VendorProductVersion
sqlite_jdbc_projectsqlite_jdbc
3.6.14.1 ≤
𝑥
< 3.41.2.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
xerial-sqlite-jdbc
bookworm
3.40.1.0+dfsg-1+deb12u1
fixed
sid
3.46.1.3+dfsg-1
fixed
trixie
3.46.1.3+dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
xerial-sqlite-jdbc
bionic
dne
focal
dne
jammy
needs-triage
kinetic
ignored
lunar
ignored
mantic
ignored
noble
needs-triage
oracular
not-affected
trusty
ignored
xenial
ignored
Common Weakness Enumeration
References
https://github.com/xerial/sqlite-jdbc/releases/tag/3.41.2.2
https://github.com/xerial/sqlite-jdbc/security/advisories/GHSA-6phf-6h5g-97j2
https://github.com/xerial/sqlite-jdbc/releases/tag/3.41.2.2
https://github.com/xerial/sqlite-jdbc/security/advisories/GHSA-6phf-6h5g-97j2