SQLite SQLite3 make alltest sqlite3session.c sessionReadRecord heap-based overflow
Priority HIGH 65CWE-122Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01464 73rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 7 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SQLite | SQLite3 | 3.0; 3.1; 3.2; 3.3; 3.4; 3.5; 3.6; 3.7; 3.8; 3.9; 3.10; 3.11; 3.12; 3.13; 3.14; 3.15; 3.16; 3.17; 3.18; 3.19; 3.20; 3.21; 3.22; 3.23; 3.24; 3.25; 3.26; 3.27; 3.28; 3.29; 3.30; 3.31; 3.32; 3.33; 3.34; 3.35; 3.36; 3.37; 3.38; 3.39; 3.40; 3.41; 3.42; 3.43 | — | No fix listed | CNA |
- SQLite3 VendorSQLite Affected 3.0; 3.1; 3.2; 3.3; 3.4; 3.5; 3.6; 3.7; 3.8; 3.9; 3.10; 3.11; 3.12; 3.13; 3.14; 3.15; 3.16; 3.17; 3.18; 3.19; 3.20; 3.21; 3.22; 3.23; 3.24; 3.25; 3.26; 3.27; 3.28; 3.29; 3.30; 3.31; 3.32; 3.33; 3.34; 3.35; 3.36; 3.37; 3.38; 3.39; 3.40; 3.41; 3.42; 3.43 Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:* | up to 3.43.0 | Vulnerable | SQLite |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* | 39 | Vulnerable | Fedoraproject |
- cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:* Versions up to 3.43.0 Vulnerable ·SQLite
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
Remediation
Red Hat 7 advisories
- RHSA-2024:1477 Released 2024-03-25 · Red Hat rating ModerateRed Hat OpenShift for Windows Containers 8.1.2 security update
- Red Hat OpenShift Container Platform 4.13 openshift4-wincw/windows-machine-config-operator-bundle, openshift4-wincw/windows-machine-config-rhel9-operator
- RHSA-2024:1383 Released 2024-03-19 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.15.0 security, enhancement, & bug fix update
- RHODF 4.15 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-operator-bundle +23
- RHSA-2024:1107 Released 2024-03-05 · Red Hat rating Moderatesqlite security update
- Red Hat Enterprise Linux AppStream EUS (v.8.6) lemon-3.26.0-16.el8_6.2
- Red Hat Enterprise Linux BaseOS EUS (v.8.6) sqlite-3.26.0-16.el8_6.2, sqlite-devel-3.26.0-16.el8_6.2, sqlite-doc-3.26.0-16.el8_6.2 +1
Show 4 more Red Hat advisories
- RHSA-2024:1081 Released 2024-03-05 · Red Hat rating Moderatesqlite security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) sqlite-3.34.1-6.el9_2.1, sqlite-devel-3.34.1-6.el9_2.1
- Red Hat Enterprise Linux BaseOS EUS (v.9.2) sqlite-3.34.1-6.el9_2.1, sqlite-libs-3.34.1-6.el9_2.1
- RHSA-2024:0589 Released 2024-01-30 · Red Hat rating Moderatesqlite security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) lemon-3.26.0-18.el8_8.1
- Red Hat Enterprise Linux BaseOS EUS (v.8.8) sqlite-3.26.0-18.el8_8.1, sqlite-devel-3.26.0-18.el8_8.1, sqlite-doc-3.26.0-18.el8_8.1 +1
- RHSA-2024:0465 Released 2024-01-25 · Red Hat rating Moderatesqlite security update
- Red Hat Enterprise Linux AppStream (v. 9) sqlite-3.34.1-7.el9_3, sqlite-devel-3.34.1-7.el9_3
- Red Hat Enterprise Linux BaseOS (v. 9) sqlite-3.34.1-7.el9_3, sqlite-libs-3.34.1-7.el9_3
- RHSA-2024:0253 Released 2024-01-15 · Red Hat rating Moderatesqlite security update
- Red Hat Enterprise Linux AppStream (v. 8) lemon-3.26.0-19.el8_9
- Red Hat Enterprise Linux BaseOS (v. 8) sqlite-3.26.0-19.el8_9, sqlite-devel-3.26.0-19.el8_9, sqlite-doc-3.26.0-19.el8_9 +1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| RHODF 4.15 for RHEL 9 | Fixed | RHSA-2024:1383 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:0253 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:0465 |
| Red Hat Enterprise Linux AppStream EUS (v.8.6) | Fixed | RHSA-2024:1107 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2024:0589 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2024:1081 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2024:0253 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2024:0465 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.6) | Fixed | RHSA-2024:1107 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.8) | Fixed | RHSA-2024:0589 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.2) | Fixed | RHSA-2024:1081 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2024:1477 |
Not affected: 2 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
Timeline
- 2026-10-02 Threatist record created from CVE-2023-7104
- 2026-10-03 Alias added: GHSA-f92h-rw3f-8j92
References
Advisory 2
More Sqlite vulnerabilities
- TI-2026-82983 Heap buffer overflow in SQLite FTS5 rowid list merging CVSS 4.0HIGH 8.5
- TI-2025-43154 An information disclosure issue in the zipfileInflate function in the zipfile extension… CVSS 3.1HIGH 7.5
- TI-2025-06334 Integer Truncation on SQLite CVSS 4.0HIGH 7.2
- TI-2022-16180 SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if… CVSS 3.1HIGH 7.5
- TI-2021-11445 An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial… CVSS 3.1HIGH 7.5
- TI-2019-06073 Out-of-bounds read in SQLite CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-7104 · CVE Program
- CVE-2023-7104 · NVD
- FIRST EPSS
- GHSA-f92h-rw3f-8j92 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-7104 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences