CVE-2022-21227 Denial of Service (DoS)
An attacker can cause a Denial of Service by passing an invalid Function object to the sqlite3 library, crashing the V8 engine.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-21227?
CVE-2022-21227 is a high-severity denial of service vulnerability in sqlite3, published on 1 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The package sqlite3 before 5.0.3 are vulnerable to Denial of Service (DoS) which will invoke the toString function of the passed parameter. If passed an invalid Function object it will throw and crash the V8 engine.
Which versions are affected by CVE-2022-21227?
2 open source packages ship an affected version, including sqlite3. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sqlite3 npm | From 5.0.0 | 5.0.3 |
sqlite3 npm | From 5.0.0 | 5.0.3 |
Products include Ghost Sqlite3.
How do I fix CVE-2022-21227?
Upgrade sqlite3 to 5.0.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-21227 being exploited?
There is no known exploitation of CVE-2022-21227 in the wild and no public exploit code.
Other vulnerabilities in sqlite3
Sources
Also known as DEBIAN-CVE-2022-21227, GHSA-9qrh-qjmc-5w2p, UBUNTU-CVE-2022-21227.