An out of bounds read flaw was found in the SQLite component of the Chromium browser. Upstream bug(s): https://code.google.com/p/chromium/issues/detail?id=1042145 External References: https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
Created chromium tracking bugs for this issue: Affects: epel-7 [bug 1801839] Affects: fedora-all [bug 1801838]
While the chromium bug is not public yet, its id leads us to this: https://chromium.googlesource.com/chromium/src/third_party/sqlite/+/ceb771caa74af28810ca2b19fe1ad46a6b565cd8 https://chromium.googlesource.com/chromium/src/third_party/sqlite/+/ceb771caa74af28810ca2b19fe1ad46a6b565cd8/patches/0023-Do-not-allow-constant-propagation-optimization-to-ap.patch which further leads us to upstream commit: https://www.sqlite.org/src/info/1bc783da63d58b05 https://github.com/sqlite/sqlite/commit/39df24a3f02495e5ef6bb5ea8ce029a2c1e377e6 This was included in sqlite upstream version 3.31.0.
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Supplementary Via RHSA-2020:0514 https://access.redhat.com/errata/RHSA-2020:0514
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-6405
The out-of-bounds read flaw lies in function propagateConstantExprRewrite() in src/select.c, which is part of the WHERE-clause constant propagation optimization. The initial implementation of this feature was introduced in SQLite upstream version 3.25.0 with commit https://github.com/sqlite/sqlite/commit/660ee55663fb8aa26a7ebd764ec5c94440bcd62f.
Statement: This flaw did not affect the versions of SQLite as shipped with Red Hat Enterprise Linux 5, 6 and 7 as they did not include the WHERE-clause constant propagation optimization, which was introduced in a later version of the package.
Created mingw-sqlite tracking bugs for this issue: Affects: fedora-all [bug 1805307] Created sqlite tracking bugs for this issue: Affects: fedora-all [bug 1805306]
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:4442 https://access.redhat.com/errata/RHSA-2020:4442