CVE-2020-11655: sqlite +17 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2020-11655

CVSS 7.5 · High EPSS 4,3%

Kerentanan Improper Initialization pada sqlite, netapp ontap select deploy administration utility +16 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.

Rincian

Terbit di NVD: 9 April 2020
Terakhir diubah: 14 Oktober 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-665: Improper Initialization
EPSS (30 hari): 4,3% peluang dieksploitasi; lebih tinggi dari 90,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
sqlite	sqlite	Semua versi hingga 3.31.1
netapp	ontap select deploy administration utility	Semua versi
debian	debian linux	Versi 8.0
debian	debian linux	Versi 9.0
canonical	ubuntu linux	Versi 16.04
canonical	ubuntu linux	Versi 18.04
canonical	ubuntu linux	Versi 19.10
canonical	ubuntu linux	Versi 20.04
oracle	communications element manager	Versi 8.2.0 hingga 8.2.2
oracle	communications network charging and control	Versi 12.0.0 hingga 12.0.3
oracle	communications network charging and control	Versi 6.0.1
oracle	communications network charging and control	Versi 12.0.2
oracle	communications session report manager	Versi 8.2.0 hingga 8.2.2
oracle	communications session route manager	Versi 8.2.0 hingga 8.2.2
oracle	enterprise manager ops center	Versi 12.4.0.0
oracle	hyperion infrastructure technology	Versi 11.1.2.4
oracle	instantis enterprisetrack	Versi 17.1
oracle	instantis enterprisetrack	Versi 17.2
oracle	instantis enterprisetrack	Versi 17.3
oracle	mysql	Versi 8.0.0 hingga 8.0.22
oracle	mysql workbench	Semua versi hingga 8.0.22
oracle	outside in technology	Versi 8.5.4
oracle	outside in technology	Versi 8.5.5
oracle	zfs storage appliance kit	Versi 8.8
oracle	communications messaging server	Versi 8.1
siemens	sinec infrastructure network services	Semua versi sebelum 1.0.1.1
tenable	tenable.sc	Semua versi sebelum 5.19.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www3.sqlite.org/cgi/src/info/4a302b42c7bf5e11 patch · advisory vendor
https://www3.sqlite.org/cgi/src/tktview?name=af4556bb5c exploit · advisory vendor
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf patch · advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2020/05/msg00006.html mailing list · advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html mailing list · advisory pihak ketiga
https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc advisory pihak ketiga
https://security.gentoo.org/glsa/202007-26 advisory pihak ketiga
https://security.netapp.com/advisory/ntap-20200416-0001/ advisory pihak ketiga
https://usn.ubuntu.com/4394-1/ advisory pihak ketiga
https://www.oracle.com/security-alerts/cpuApr2021.html advisory pihak ketiga
https://www.oracle.com/security-alerts/cpujan2021.html advisory pihak ketiga
https://www.oracle.com/security-alerts/cpujul2020.html advisory pihak ketiga
https://www.oracle.com/security-alerts/cpuoct2020.html advisory pihak ketiga
https://www.tenable.com/security/tns-2021-14 release notes · advisory pihak ketiga
https://cert-portal.siemens.com/productcert/html/ssa-389290.html
https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 14 Okt 2026, 18:26 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.