Fluid Attacks Database

Description

The package sqlite3 before 5.0.3 are vulnerable to Denial of Service (DoS) which will invoke the toString function of the passed parameter. If passed an invalid Function object it will throw and crash the V8 engine.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
npm	sqlite3	>=5.0.0 <5.0.3	5.0.3
debian 14	node-sqlite3	>=0 <5.0.6+ds1-1	5.0.6+ds1-1
debian 11	node-sqlite3	=5.0.0+ds1-1 \|\| >=0 <5.0.0+ds1-1+deb11u1	5.0.0+ds1-1+deb11u1
debian 12	node-sqlite3	>=0 <5.0.6+ds1-1	5.0.6+ds1-1
debian 13	node-sqlite3	>=0 <5.0.6+ds1-1	5.0.6+ds1-1

Aliases

1. CVE-2022-212272. NVD-2022-212273. OSV-2022-212274. OSV-DEBIAN-2022-212275. GHSA-9qrh-qjmc-5w2p6. GCVE-2022-212277. SECURITY-TRACKER-CVE-2022-21227

References

1. https://github.com/TryGhost/node-sqlite3/security/advisories/GHSA-9qrh-qjmc-5w2p2. https://github.com/TryGhost/node-sqlite3/issues/14403. https://github.com/TryGhost/node-sqlite3/issues/14494. https://github.com/TryGhost/node-sqlite3/commit/593c9d498be2510d286349134537e3bf89401c4a

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.