Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.

Bug 1782000 (CVE-2019-13753)

Summary:	CVE-2019-13753 sqlite: fts3: incorrectly removed corruption check
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	databases-maint, drizt72, erack, erik-fedora, fedora, itamar, jstanek, mschorm, odubaj, pkubat, praiskup, rh-spice-bugs, rjones, tcallawa, tpopela, wilmer5, yaneti
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	chromium-browser 79.0.3945.79	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-12-16 14:10:48 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1782011, 1782012, 1782013, 1786531, 1786532, 1786533, 1786534, 1786535
Bug Blocks:

Description Pedro Sampaio 2019-12-11 01:05:28 UTC

An out of bounds read flaw was found in the SQLite component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1025471

External References:

https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html

Comment 1 Pedro Sampaio 2019-12-11 01:22:12 UTC

Created chromium tracking bugs for this issue:

Affects: epel-7 [bug 1782013]
Affects: fedora-all [bug 1782012]

Comment 3 errata-xmlrpc 2019-12-16 09:09:04 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Supplementary

Via RHSA-2019:4238 https://access.redhat.com/errata/RHSA-2019:4238

Comment 4 Product Security DevOps Team 2019-12-16 14:10:48 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-13753

Comment 5 Tomas Hoger 2019-12-17 22:53:28 UTC

While the chromium bug is not public yet, its id leads us to this:

https://chromium.googlesource.com/chromium/src/third_party/sqlite/+/47bd97d715260127c995d92dde8dd8adb669b6b3
https://chromium.googlesource.com/chromium/src/third_party/sqlite/+/47bd97d715260127c995d92dde8dd8adb669b6b3/patches/0004-Remove-reachable-NEVER-in-fts3.patch

which further leads us to upstream commit:

https://www.sqlite.org/src/info/8bd75bf636f72f32
https://github.com/sqlite/sqlite/commit/fd6bf04bba8035836e8f92771d277a4e868c6299

There is no released sqlite version with the fix yet.

Comment 6 Huzaifa S. Sidhpurwala 2019-12-26 04:54:39 UTC

This is related to CVE-2019-13752. The only difference being that CVE-2019-13752 is related to fts3NodeAddTerm, while this CVE is related to fts3IncrmergePush. The patch described in comment #5 needs to be applied after the  CVE-2019-13752 patch.

Comment 7 Huzaifa S. Sidhpurwala 2019-12-26 04:55:16 UTC

Created mingw-sqlite tracking bugs for this issue:

Affects: epel-all [bug 1786533]
Affects: fedora-all [bug 1786532]


Created sqlite tracking bugs for this issue:

Affects: fedora-all [bug 1786531]

Comment 9 errata-xmlrpc 2020-04-28 15:55:15 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1810 https://access.redhat.com/errata/RHSA-2020:1810