{"id":"CVE-2022-46908","aliases":["AZL-11586","BELL-CVE-2022-46908","BIT-sqlite-2022-46908","DEBIAN-CVE-2022-46908","EUVD-2022-49687","GHSA-993x-6558-2xmj","MGASA-2023-0094","OESA-2022-2146","OESA-2023-1219","SUSE-SU-2022:4603-1","SUSE-SU-2022:4628-1","SUSE-SU-2023:1295-1","SUSE-SU-2023:2668-1","UBUNTU-CVE-2022-46908","USN-6566-1","openSUSE-SU-2024:12574-1"],"status":"published","title":"SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not...","description":"SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00446,"percentile":0.39076,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-12-12T00:00:00Z","modified":"2026-11-03T06:03:01Z","fixes":[{"ecosystem":"Azure Linux:2","package":"sqlite","fixed_in":["3.39.2-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"sqlite","fixed_in":["3.40.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"sqlite","fixed_in":["3.40.1-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"sqlite","fixed_in":["3.40.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"sqlite3","fixed_in":["3.40.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sqlite3","fixed_in":["3.40.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sqlite3","fixed_in":["3.40.0-2"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"sqlite3","fixed_in":["3.39.2-1.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"sqlite","fixed_in":["3.37.2-4.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"sqlite","fixed_in":["3.37.2-5.oe2203sp1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"sqlite3","fixed_in":["3.39.3-9.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"sqlite3","fixed_in":["3.39.3-9.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"sqlite3","fixed_in":["3.39.3-9.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"sqlite3","fixed_in":["3.39.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"sqlite3","fixed_in":["3.39.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"sqlite3","fixed_in":["3.39.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"sqlite3","fixed_in":["3.39.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"sqlite3","fixed_in":["3.39.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.2","package":"sqlite3","fixed_in":["3.39.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"sqlite3","fixed_in":["3.39.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"sqlite3","fixed_in":["3.39.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"sqlite3","fixed_in":["3.39.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"sqlite3","fixed_in":["3.39.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"sqlite3","fixed_in":["3.39.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"sqlite3","fixed_in":["3.39.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"sqlite3","fixed_in":["3.39.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"sqlite3","fixed_in":["3.39.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"sqlite3","fixed_in":["3.39.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"sqlite3","fixed_in":["3.39.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"sqlite3","fixed_in":["3.39.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"sqlite3","fixed_in":["3.39.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"sqlite3","fixed_in":["3.39.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.2","package":"sqlite3","fixed_in":["3.39.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.2","package":"sqlite3","fixed_in":["3.39.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"sqlite3","fixed_in":["3.39.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"sqlite3","fixed_in":["3.39.3-150000.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"sqlite3","fixed_in":["3.39.3-9.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"sqlite3","fixed_in":["3.39.3-9.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"sqlite3","fixed_in":["3.39.3-9.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"sqlite3","fixed_in":["3.39.3-9.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"sqlite3","fixed_in":["3.39.3-9.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"sqlite3","fixed_in":["3.39.3-9.26.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"sqlite3","fixed_in":["3.37.2-2ubuntu0.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"sqlite3","fixed_in":["3.40.0-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.2-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.40.0-r0"},{"fixed":"3.40.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.40.0-r0"},{"fixed":"3.40.1-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"sqlite","ranges":[{"type":"SEMVER","events":[{"introduced":"3.37.0"},{"fixed":"3.40.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.0-2"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.2-1.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.37.2-4.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.37.2-5.oe2203sp1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-9.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-9.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-9.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.2","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-150000.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-9.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-9.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-9.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-9.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-9.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39.3-9.26.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.37.2-2ubuntu0.3"}]}],"versions":["3.35.5-1","3.36.0-2","3.37.2-2","3.37.2-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.31.1-4ubuntu0.6"}]}],"versions":["3.29.0-2","3.30.1-1","3.30.1-1ubuntu1","3.31.1-1ubuntu1","3.31.1-3","3.31.1-4","3.31.1-4ubuntu0.1","3.31.1-4ubuntu0.2","3.31.1-4ubuntu0.3","3.31.1-4ubuntu0.4","3.31.1-4ubuntu0.5"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.37.2-2ubuntu0.3"}]}],"versions":["3.35.5-1","3.36.0-2","3.37.2-2","3.37.2-2ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.0-2.1"}]}]}],"products":[{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"sqlite","product":"sqlite"}],"references":[{"url":"https://news.ycombinator.com/item?id=33948588","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","advisory","web","report"]},{"url":"https://sqlite.org/forum/forumpost/07beac8056151b2f","tags":["x_transferred","Exploit","Issue Tracking","Vendor Advisory","advisory","web","report"]},{"url":"https://sqlite.org/src/info/cefc032473ac5ad2","tags":["x_transferred","Patch","Vendor Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20230203-0005/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202311-03","tags":["vendor-advisory","x_transferred","web","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-556635.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46908","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230203-0005"},{"url":"https://github.com/advisories/GHSA-993x-6558-2xmj"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-46908","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46908.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-46908","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0094.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31312","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-December/013303.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XNUCFJDJQRYX6KHGSM7ODVW7QJMN7GP5/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2146","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1219","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224603-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1206337","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-46908","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224628-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231295-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232668-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-46908","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6566-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-46908","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-7104","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-46908","description":"SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.","status":"published","published":"2022-12-12T00:00:00Z","modified":"2026-10-14T18:35:37.667Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:34:32.156873Z"}],"euvd":[{"id":"EUVD-2022-49687","description":"SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.","status":"published","published":"2022-12-12T00:00:00Z","modified":"2026-10-14T18:35:37Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T17:27:13.272666Z"}],"ghsa":[{"id":"GHSA-993x-6558-2xmj","title":"SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not...","description":"SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.","status":"published","published":"2022-12-12T06:30:15Z","modified":"2026-10-14T21:31:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:13:28.606179Z"}],"nvd":[{"id":"CVE-2022-46908","description":"SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.","status":"published","published":"2022-12-12T06:15:10.793Z","modified":"2026-10-14T19:16:55.133Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"primary"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:07:33.239526Z"}],"osv":[{"id":"AZL-11586","title":"CVE-2022-46908 affecting package sqlite for versions less than 3.39.2-2","description":"SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.","status":"published","published":"2022-12-12T06:15:10Z","modified":"2026-04-21T04:22:18.07524Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:28:02.666535Z"},{"id":"BELL-CVE-2022-46908","status":"published","published":"2022-12-12T06:15:00Z","modified":"2026-01-26T09:33:00.575367Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-46908","description":"SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.","status":"published","published":"2022-12-12T00:00:00Z","modified":"2026-10-28T02:31:03.827056584Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:44:27.481647Z"},{"id":"OESA-2022-2146","title":"sqlite security update","description":"\r\n\r\nSecurity Fix(es):\r\n\r\nSQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.(CVE-2022-46908)","status":"published","published":"2022-12-24T11:05:27Z","modified":"2026-08-18T01:17:27.151011844Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"OESA-2023-1219","title":"sqlite security update","description":"SQLite is a C-language library that implements a small, fast, self-contained, high-reliability, full-featured, SQL database engine. SQLite is the most used database engine in the world. SQLite is built into all mobile phones and most computers and comes bundled inside countless other applications that people use every day.It also include lemon and sqlite3_analyzer and tcl tools.\r\n\r\nSecurity Fix(es):\r\n\r\nSQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.(CVE-2022-46908)","status":"published","published":"2022-12-24T11:05:41Z","modified":"2026-08-18T01:17:39.295252298Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"UBUNTU-CVE-2022-46908","description":"SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.","status":"published","published":"2022-12-12T06:15:00Z","modified":"2026-04-22T13:31:53.390656Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T16:53:56.473586Z"},{"id":"BIT-sqlite-2022-46908","description":"SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.","status":"published","published":"2024-03-06T11:05:50.187Z","modified":"2026-09-08T08:48:19.48390858Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"DEBIAN-CVE-2022-46908","description":"SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.","status":"published","published":"2022-12-12T06:15:10.793Z","modified":"2026-11-03T06:03:01.962008814Z","updated_at":"2026-11-03T06:43:01.507088Z"},{"id":"MGASA-2023-0094","title":"Updated sqlite3 packages fix security vulnerability","description":"SQLite through 3.40.0, when relying on --safe for execution of an\nuntrusted CLI script, does not properly implement the\nazProhibitedFunctions protection mechanism, and instead allows UDF\nfunctions such as WRITEFILE. (CVE-2022-46908)\n","status":"published","published":"2023-03-18T22:16:28Z","modified":"2026-04-16T04:41:01.477858146Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12574-1","title":"libsqlite3-0-3.40.0-2.1 on GA media","description":"These are all security issues fixed in the libsqlite3-0-3.40.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:50:03.251248Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2022:4603-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\n- CVE-2022-46908: Properly implement the azProhibitedFunctions protection mechanism,\n  when relying on --safe for execution of an untrusted CLI script (bsc#1206337).\n","status":"published","published":"2022-12-21T12:49:53Z","modified":"2026-02-04T04:01:33.724113Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2022:4628-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\n- CVE-2022-46908: Properly implement the azProhibitedFunctions protection mechanism, \n  when relying on --safe for execution of an untrusted CLI script (bsc#1206337).\n","status":"published","published":"2022-12-28T08:23:28Z","modified":"2026-02-04T03:08:27.548974Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:1295-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\n- CVE-2022-46908: Properly implement the azProhibitedFunctions protection mechanism, \n  when relying on --safe for execution of an untrusted CLI script (bsc#1206337).\n","status":"published","published":"2023-06-29T17:54:04Z","modified":"2026-02-04T02:44:36.28662Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:2668-1","title":"Security update for sqlite3","description":"This update for sqlite3 fixes the following issues:\n\n- CVE-2022-46908: Properly implement the azProhibitedFunctions protection mechanism,\n  when relying on --safe for execution of an untrusted CLI script (bsc#1206337).\n","status":"published","published":"2023-06-28T07:18:43Z","modified":"2026-02-04T02:58:24.927202Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"USN-6566-1","title":"sqlite3 vulnerabilities","description":"It was discovered that SQLite incorrectly handled certain protection\nmechanisms when using a CLI script with the --safe option, contrary to\nexpectations. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-46908)\n\nIt was discovered that SQLite incorrectly handled certain memory operations\nin the sessions extension. A remote attacker could possibly use this issue\nto cause SQLite to crash, resulting in a denial of service. (CVE-2023-7104)\n","status":"published","published":"2024-01-03T18:09:00Z","modified":"2026-04-27T17:17:25.237054339Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}