Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-46908: SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.
Fixed packages 15
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | lemon | 0:3.40.0-1.amzn2023.0.5 |
| Amazon Linux · 2023 | lemon-debuginfo | 0:3.40.0-1.amzn2023.0.5 |
| Amazon Linux · 2023 | sqlite | 0:3.40.0-1.amzn2023.0.5 |
| Amazon Linux · 2023 | sqlite-analyzer | 0:3.40.0-1.amzn2023.0.5 |
| Amazon Linux · 2023 | sqlite-analyzer-debuginfo | 0:3.40.0-1.amzn2023.0.5 |
| Amazon Linux · 2023 | sqlite-debuginfo | 0:3.40.0-1.amzn2023.0.5 |
| Amazon Linux · 2023 | sqlite-debugsource | 0:3.40.0-1.amzn2023.0.5 |
| Amazon Linux · 2023 | sqlite-devel | 0:3.40.0-1.amzn2023.0.5 |
| Amazon Linux · 2023 | sqlite-doc | 0:3.40.0-1.amzn2023.0.5 |
| Amazon Linux · 2023 | sqlite-libs | 0:3.40.0-1.amzn2023.0.5 |
| Amazon Linux · 2023 | sqlite-libs-debuginfo | 0:3.40.0-1.amzn2023.0.5 |
| Amazon Linux · 2023 | sqlite-tcl | 0:3.40.0-1.amzn2023.0.5 |
| Amazon Linux · 2023 | sqlite-tcl-debuginfo | 0:3.40.0-1.amzn2023.0.5 |
| Amazon Linux · 2023 | sqlite-tools | 0:3.40.0-1.amzn2023.0.5 |
| Amazon Linux · 2023 | sqlite-tools-debuginfo | 0:3.40.0-1.amzn2023.0.5 |
Vulnerabilities 1
-
High 7.3
SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-46908.html