CVE-2023-32697

SQLite JDBC is a library for accessing and creating SQLite database files in Java. Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL. This issue impacting versions 3.6.14.1 through 3.41.2.1 and has been fixed in version 3.41.2.2.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub_MCNA
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 87%
VendorProductVersion
sqlite_jdbc_projectsqlite_jdbc
3.6.14.1 ≤
𝑥
< 3.41.2.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
xerial-sqlite-jdbc
bookworm
3.40.1.0+dfsg-1+deb12u1
fixed
sid
3.46.1.3+dfsg-1
fixed
trixie
3.46.1.3+dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
xerial-sqlite-jdbc
oracular
not-affected
noble
needs-triage
mantic
ignored
lunar
ignored
kinetic
ignored
jammy
needs-triage
focal
dne
bionic
dne
xenial
ignored
trusty
ignored