CVE-2019-19317 is a critical vulnerability in SQLite 3.30.1, specifically within the lookupName function in resolve.c, which fails to properly handle generated columns, leading to a denial of service or potentially other unspecified impacts. With a CVSS score of 9.8, it presents a severe risk as it can be exploited remotely with low attack complexity, potentially leading to high confidentiality, integrity, and availability impacts. Despite its high severity, there is no evidence of active exploitation, no known public exploit code (Metasploit, Nuclei, ExploitDB), and minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
3.30.1CPE matchmatch criteria | cpe:2.3:a:sqlite:sqlite:3.30.1:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* | ||
<= 8.0.19CPE matchmatch criteria | cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:* | ||
< 1.0.1.1CPE matchmatch criteria | cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact.
Dec 10, 2019sqlite: omits bits from the colUsed bitmask in the case of a generated column
Dec 5, 2019