| Name | CVE-2022-21227 |
| Description | The package sqlite3 before 5.0.3 are vulnerable to Denial of Service (DoS) which will invoke the toString function of the passed parameter. If passed an invalid Function object it will throw and crash the V8 engine. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| node-sqlite3 (PTS) | buster | 4.0.6+ds1-2 | fixed |
| bullseye (security), bullseye | 5.0.0+ds1-1+deb11u2 | fixed |
| sid, trixie, bookworm | 5.1.5+ds1-1 | fixed |
The information below is based on the following data on fixed versions.
Notes
[buster] - node-sqlite3 <not-affected> (Vulnerable code introduced later)
[stretch] - node-sqlite3 <end-of-life> (Nodejs in stretch not covered by security support)
https://github.com/advisories/GHSA-9qrh-qjmc-5w2p
Fixed by: https://github.com/TryGhost/node-sqlite3/commit/593c9d498be2510d286349134537e3bf89401c4a (v5.0.3)
https://security.snyk.io/vuln/SNYK-JS-SQLITE3-2388645
Introduced by: https://github.com/TryGhost/node-sqlite3/commit/dd3ef522088bb5cafede25b9fe661f892b6f10ba (v5.0.0)