GHSA-jqv5-7xpx-qj74

Source

https://github.com/advisories/GHSA-jqv5-7xpx-qj74

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-jqv5-7xpx-qj74/GHSA-jqv5-7xpx-qj74.json

Aliases

• CVE-2022-43441

Published

2023-03-13T20:00:52Z

Modified

2023-11-08T04:10:44.194191Z

Details

Impact

Due to the underlying implementation of .ToString(), it's possible to execute arbitrary JavaScript, or to achieve a denial-of-service, if a binding parameter is a crafted Object.

Users of sqlite3 v5.0.0 - v5.1.4 are affected by this.

Patches

Fixed in v5.1.5. All users are recommended to upgrade to v5.1.5 or later.

Workarounds

• Ensure there is sufficient sanitization in the parent application to protect against invalid values being supplied to binding parameters.

References

• Commit: https://github.com/TryGhost/node-sqlite3/commit/edb1934dd222ae55632e120d8f64552d5191c781

For more information

If you have any questions or comments about this advisory:

• Email us at security@ghost.org

Credits: Dave McDaniel of Cisco Talos

References

• https://github.com/TryGhost/node-sqlite3/security/advisories/GHSA-jqv5-7xpx-qj74
• https://nvd.nist.gov/vuln/detail/CVE-2022-43441
• https://github.com/TryGhost/node-sqlite3/commit/edb1934dd222ae55632e120d8f64552d5191c781
• https://github.com/TryGhost/node-sqlite3
• https://talosintelligence.com/vulnerability_reports/TALOS-2022-1645