CVE-2023-7104: sqlite through 3.43.0 (inclusive); +5 more affected products

Affected technology

sqlite · through 3.43.0 (inclusive)
sqlite

fedora · 38
fedoraproject

fedora · 39
fedoraproject

SQLite3 · 3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, 3.16, 3.17, 3.18, 3.19, 3.20, 3.21, 3.22, 3.23, 3.24, 3.25, 3.26, 3.27, 3.28, 3.29, 3.30, 3.31, 3.32, 3.33, 3.34, 3.35, 3.36, 3.37, 3.38, 3.39, 3.40, 3.41, 3.42, 3.43
SQLite

RUGGEDCOM CROSSBOW Station Access Controller (SAC) · 0 to before V5.6
Siemens

SIDIS Prime · 0 to before V4.0.700
Siemens

SIMATIC S7-1500 TM MFP - GNU/Linux subsystem · 0 to before V1.1
Siemens

Description’s affected range: up to 3.43.0 and classified as critical

Component: make alltest Handler
Function: sessionReadRecord
File: ext/session/sqlite3session.c

Attack conditions (VulDB, CVSS 3.1): Adjacent network · Low privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

VulDB’s CVSS 3.1 assessment (base score 5.5/10) rates confidentiality, integrity and availability impact as low. NVD’s CVSS 3.1 assessment (base score 7.3/10) rates confidentiality, integrity and availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.