https://www.sqlite.org/src/info/cd708fa84d2aaaea

https://www.sqlite.org/src/info/c8d3b9f0a750a529

https://www.sqlite.org/src/info/79eff1d0383179c4

https://security.netapp.com/advisory/ntap-20200619-0002/

GLSA-202007-26

FEDORA-2020-d0f892b069

[debian-lts-announce] 20200822 [SECURITY] [DLA 2340-1] sqlite3 security update

https://www.oracle.com/security-alerts/cpujan2021.html

https://www.oracle.com/security-alerts/cpuApr2021.html

https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

The version of Oracle MySQL Workbench installed on the remote Windows host is prior to 8.0.23. It is, therefore, affected by multiple vulnerabilities as referenced in the advisory.

    - SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window     functions is too late. (CVE-2020-13871)

    - The X.509 GeneralName type is a generic type for representing different types of names. One of those name types     is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a     GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an     EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack.
    (CVE-2020-1971)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the sqlite package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In SQLite before 3.32.3, select.c mishandles     query-flattener optimization, leading to a     multiSelectOrderBy heap overflow because of misuse of     transitive properties for constant     propagation.(CVE-2020-15358)

  - SQLite 3.32.2 has a use-after-free in resetAccumulator     in select.c because the parse tree rewrite for window     functions is too late.(CVE-2020-13871)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Rebased to version 3.33.0

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202007-26 (SQLite: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in SQLite. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
150416	Oracle MySQL Workbench < 8.0.23 Multiple Vulnerabilities (Jan 2021)	Nessus	Windows	high
147482	EulerOS Virtualization 2.9.1 : sqlite (EulerOS-SA-2021-1626)	Nessus	Huawei Local Security Checks	high
139711	Fedora 32 : sqlite (2020-d0f892b069)	Nessus	Fedora Local Security Checks	high
138949	GLSA-202007-26 : SQLite: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical

CVE-2020-13871

high

Tenable Plugins

high

high

high

critical