CVE-2018-20505 Denial of service in n/a
Remote attackers can crash SQLite applications by running SQL queries on tables with malformed primary keys, affecting systems using WebSQL.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-20505?
CVE-2018-20505 is a high-severity denial of service vulnerability in Apple Icloud, published on 3 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases).
Weakness: CWE-89
Which versions are affected by CVE-2018-20505?
It affects 6 products.
Products include Apple Icloud, Apple Iphone Os, Apple Itunes, Apple Mac Os X, Apple Watchos, Sqlite Sqlite.
How do I fix CVE-2018-20505?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-20505 being exploited?
There is no known exploitation of CVE-2018-20505 in the wild and no public exploit code.
Other vulnerabilities in Apple Icloud
Sources
Also known as AZL-38170, DEBIAN-CVE-2018-20505, GHSA-rx75-3g2g-6hp5, UBUNTU-CVE-2018-20505.