CVE-2020-24736 - Vulnerability Details - OpenCVE

Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and before allows a local attacker to cause a denial of service via a crafted script.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Ghost	Sqlite3
Redhat	Enterprise Linux Rhel Eus

Configuration 1 [-]

cpe:2.3:a:ghost:sqlite3:3.27.1:*:*:*:*:node.js:*:*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 8
sqlite-0:3.26.0-18.el8_8	cpe:/a:redhat:enterprise_linux:8	RHSA-2023:3840	2023-06-27T00:00:00Z
sqlite-0:3.26.0-18.el8_8	cpe:/o:redhat:enterprise_linux:8	RHSA-2023:3840	2023-06-27T00:00:00Z
Red Hat Enterprise Linux 8.6 Extended Update Support
sqlite-0:3.26.0-16.el8_6.1	cpe:/a:redhat:rhel_eus:8.6	RHSA-2024:0425	2024-01-25T00:00:00Z

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2020-24736
https://security.netapp.com/advisory/ntap-20230526-0005/
https://www.cve.org/CVERecord?id=CVE-2020-24736
https://www.sqlite.org/src/info/4feb3159c6bc3f7e33959

History

Tue, 11 Feb 2025 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-04-11T00:00:00.000Z

Updated: 2025-02-11T17:33:13.249Z

Reserved: 2020-08-28T00:00:00.000Z

Link: CVE-2020-24736

Vulnrichment

Updated: 2024-08-04T15:19:09.427Z

NVD

Status : Modified

Published: 2023-04-11T18:15:58.280

Modified: 2025-02-11T18:15:19.540

Link: CVE-2020-24736

Redhat

Severity : Moderate

Publid Date: 2023-04-11T00:00:00Z

Links: CVE-2020-24736 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2020-24736", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-02-11T17:33:13.249Z", "dateReserved": "2020-08-28T00:00:00.000Z", "datePublished": "2023-04-11T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-05-26T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and before allows a local attacker to cause a denial of service via a crafted script."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://www.sqlite.org/src/info/4feb3159c6bc3f7e33959"}, {"url": "https://security.netapp.com/advisory/ntap-20230526-0005/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T15:19:09.427Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.sqlite.org/src/info/4feb3159c6bc3f7e33959", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20230526-0005/", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-120", "lang": "en", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-02-11T17:30:13.304227Z", "id": "CVE-2020-24736", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-11T17:33:13.249Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.sqlite.org/src/info/4feb3159c6bc3f7e33959", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20230526-0005/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T15:19:09.427Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2020-24736", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-11T17:30:13.304227Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-120", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-11T17:30:56.608Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://www.sqlite.org/src/info/4feb3159c6bc3f7e33959"}, {"url": "https://security.netapp.com/advisory/ntap-20230526-0005/"}], "descriptions": [{"lang": "en", "value": "Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and before allows a local attacker to cause a denial of service via a crafted script."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-05-26T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2020-24736", "state": "PUBLISHED", "dateUpdated": "2025-02-11T17:33:13.249Z", "dateReserved": "2020-08-28T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2023-04-11T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ghost:sqlite3:3.27.1:*:*:*:*:node.js:*:*", "matchCriteriaId": "2935F3E9-13D5-415B-9ECB-88D5B5DF9C68", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and before allows a local attacker to cause a denial of service via a crafted script."}], "id": "CVE-2020-24736", "lastModified": "2025-02-11T18:15:19.540", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-04-11T18:15:58.280", "references": [{"source": "cve@mitre.org", "url": "https://security.netapp.com/advisory/ntap-20230526-0005/"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://www.sqlite.org/src/info/4feb3159c6bc3f7e33959"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20230526-0005/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://www.sqlite.org/src/info/4feb3159c6bc3f7e33959"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-120"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}