Amazon Linux 2023 : lemon, sqlite, sqlite-analyzer (ALAS2023-2026-3452)

high Nessus Plugin ID 379873

Synopsis

The remote Amazon Linux 2023 host is missing a security update.

Description

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3452 advisory.

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it.
Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process.
(CVE-2026-119371)

SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process. (CVE-2026-119372)

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process. (CVE-2026-119373)

SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers. (CVE-2026-119375)

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process. (CVE-2026-119376)

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions. (CVE-2026-119377)

SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits. (CVE-2026-119378)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'dnf update sqlite --releasever 2023.12.20261112' or or 'dnf update --advisory ALAS2023-2026-3452 --releasever 2023.12.20261112' to update your system.

Plugin Details

Severity: High

ID: 379873

File Name: al2023_ALAS2023-2026-3452.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 11/12/2026

Updated: 11/12/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.6

CVSS v2

Risk Factor: Low

Base Score: 1.7

Temporal Score: 1.3

Vector: CVSS2#AV:L/AC:L/Au:S/C:P/I:N/A:N

CVSS Score Source: CVE-2026-119377

CVSS v3

Risk Factor: Low

Base Score: 3.3

Temporal Score: 3

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.5

Threat Score: 7.1

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-119373

Vulnerability Information

CPE: cpe:/o:amazon:linux:2023, p-cpe:/a:amazon:linux:lemon-debuginfo, p-cpe:/a:amazon:linux:lemon, p-cpe:/a:amazon:linux:sqlite-analyzer-debuginfo, p-cpe:/a:amazon:linux:sqlite-analyzer, p-cpe:/a:amazon:linux:sqlite-debuginfo, p-cpe:/a:amazon:linux:sqlite-debugsource, p-cpe:/a:amazon:linux:sqlite-devel, p-cpe:/a:amazon:linux:sqlite-doc, p-cpe:/a:amazon:linux:sqlite-libs-debuginfo, p-cpe:/a:amazon:linux:sqlite-libs, p-cpe:/a:amazon:linux:sqlite-tcl-debuginfo, p-cpe:/a:amazon:linux:sqlite-tcl, p-cpe:/a:amazon:linux:sqlite-tools-debuginfo, p-cpe:/a:amazon:linux:sqlite-tools, p-cpe:/a:amazon:linux:sqlite

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/12/2026

Vulnerability Publication Date: 10/30/2026

Reference Information

CVE: CVE-2026-119371, CVE-2026-119372, CVE-2026-119373, CVE-2026-119375, CVE-2026-119376, CVE-2026-119377, CVE-2026-119378

Detections

Analytics