CVE-2020-35527 Memory corruption in sqlite
An out-of-bounds access in SQLite allows attackers to cause denial of service or potentially execute code via crafted ALTER TABLE commands on views.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-35527?
CVE-2020-35527 is a critical memory corruption vulnerability in Netapp Ontap Select Deploy Administration Utility, published on 1 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause.
Weakness: CWE-119
Which versions are affected by CVE-2020-35527?
1 open source package ship an affected version, including sqlite. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
sqlite Bitnami | From 3.31.1 | 3.31.2 |
Products include Netapp Ontap Select Deploy Administration Utility, Sqlite Sqlite.
How do I fix CVE-2020-35527?
Upgrade sqlite to 3.31.2 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-35527 being exploited?
There is no known exploitation of CVE-2020-35527 in the wild and no public exploit code.
Other vulnerabilities in Netapp Ontap Select Deploy Administration Utility
- CVE-2020-11656 Use after free in n/a
- CVE-2019-5509 Code injection in ONTAP Select Deploy administration utility
- CVE-2019-5504 Missing authorization in ONTAP Select Deploy administration utility
- CVE-2019-5505 Information disclosure in ONTAP Select Deploy administration utility
- CVE-2024-21989 Privilege Escalation Vulnerability in ONTAP Select Deploy administration utility
All Netapp Ontap Select Deploy Administration Utility vulnerabilities
Sources
Also known as BIT-sqlite-2020-35527, CLSA-2022-1667513276, CLSA-2022-1667513366, DEBIAN-CVE-2020-35527, GHSA-c76x-fv7r-4xjr, UBUNTU-CVE-2020-35527.