Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > muc.lists.freebsd.security > #4251

Re: How to fix sqlite3 vulnerable

Show all headers | View raw

Masachika ISHIZUKA <ish@ish.org> writes:
> From this morning, I received security notice as bellows.
> | Checking for security vulnerabilities in base (userland & kernel):
> | Database fetched: 2026-11-04T03:45+09:00
> | 0 problem(s) in 0 package(s) found.
> | FreeBSD-15.1_6 is vulnerable:
> |   sqlite3 -- multiple vulnerabilities
> | [...]
>   How to fix this FreeBSD-15.1_6 vulnerabilities ?

Presumably a patch will be provided in the next round of security
advisories, but in the meantime you can safely ignore them.  All of
these CVEs require the attacker to provide either a malicious database
file which causes sqlite3 to malfunction when read or a malicious query
which causes sqlite3 to malfunction when executed.  The base system
version of sqlite3 is only used by Kerberos (mainly the KDC and admin
tools that access the KDC's database) and Kyua, and neither of those
operate on user-provided databases or execute user-provided queries.

If you are using pkgbase, assuming you are not running a KDC, you can
use the following command to remove sqlite3 without removing any of its
dependents:

    # pkg remove -f FreeBSD-libsqlite3

This will prevent e.g. kdc and kyua from running, but not pam_krb5,
which does not use sqlite3.

(perhaps we should split the kerberos package into server-side and
client-side?)

DES
-- 
Dag-Erling Smørgrav - des@FreeBSD.org


--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-admin@muc.de

Back to muc.lists.freebsd.security | Previous — Previous in thread | Find similar | Unroll thread

Thread

How to fix sqlite3 vulnerable Masachika ISHIZUKA <ish@ish.org> - 2026-11-05 08:58 +0900
  Re: How to fix sqlite3 vulnerable Dag-Erling Smørgrav <des@FreeBSD.org> - 2026-11-05 16:40 +0100

csiph-web