News for hackers. Stuff that matters.

A comment on Remote code execution vulnerability in SQLite. Parent comment

Re:Remote code execution vulnerability in SQLite by jdright on Friday December 14, 2018 @05:43PM (#18685577)
They are giving time to more SQLite users to patch and waiting the CVE to be assigned. Looking at the chromium patch, this has something to do with ALTER TABLE. Looking at SQLite release notes they clearly are hiding the real nature of the issue there. For instance, see this: https://www.sqlite.org/lang_altertable.html

"Compatibility Note: The behavior of ALTER TABLE when renaming a table was enhanced in versions 3.25.0 (2018-09-15) and 3.26.0 (2018-12-01) in order to carry the rename operation forward into triggers and views that reference the renamed table. This is considered an improvement. Applications that depend on the older (and arguably buggy)..."

A problem that (well tailored) enables a RCE is just "arguably buggy" in their view?

[ Parent | on HN ]
Re:Remote code execution vulnerability in SQLite by EvanAnderson on Friday December 14, 2018 @06:14PM (#18685791)
I think it relates to "ALTER TABLE" too-- specially: https://www.sqlite.org/src/info/6e1330545e7b74fe

The comments in checkin a61ed147 for "renameColumnFunc()" give me the willies.

[ Parent | on HN ]