SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.

Etkilenen sürümler1 yazılım

Kaynaklar12 kaynak

• CVE.org kaydı
• NVD kaydı
• sqlite.org/src/info/bbd69ce274620008 Yama
• github.com/…ommit/7ff247c5b9ead3ad8a69c26d3fd264878e127237 Yama
• sqlite.org/src/info/2cb22877683680c1 Yama
• github.com/…ommit/5694c3bb2a6a40770ecd2f65910eea756734dfd8 Yama
• sqlite.org/bugs/info/2026-07-05T08:15:45Z Üçüncü taraf
• abraxaslabs.tech/research/sqlite-fj-using-auth Üçüncü taraf
• vulncheck.com/…authorizer-bypass-via-right-or-full-join-using Üçüncü taraf
• github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.c Diğer
• sqlite.org/releaselog/3_54_0.html Diğer
• github.com/sqlite/sqlite Diğer

Kayıt geçmişi

1. 30 Eki 2026 14:30Yayımlandı

İlgili açıklar

• 7,8 CVE-2026-119586SQLite CLI through 3.54.1 Command Injection via .recover Output
• 5,5 CVE-2026-119591SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause
• 7,8 CVE-2026-119379SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()
• 5,5 CVE-2026-119378SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()
• 5,5 CVE-2026-119376SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain
• 5,5 CVE-2026-119375SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch