CVE-2019-19244
sqlite: allows a crash if a sub-select uses both DISTINCT and window functions and also has certain ORDER BY usage
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · November 22, 2019
Updated · October 9, 2026
Description
A flaw was found in the way SQLite handled certain types of SQL queries using DISTINCT, OVER and ORDER BY clauses. A remote attacker could exploit this flaw by providing a malicious SQL query that, when processed by an application linked to SQLite, would crash the application causing a denial of service.
Statement
This flaw has been rated as having a security impact of Low. The versions of sqlite as shipped with Red Hat Enterprise Linux are compiled without SQLITE_DEBUG, so it's not possible to reproduce the crash. The invalid Mem object may still lead to undefined behaviors, though no notable defects have been observed.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-20 · Improper Input Validation