Re: [sqlite] CVE-2019-19317

2019-12-15 Thread Gary R. Schmidt
On 15/12/2019 10:16, Yongheng Chen wrote: When we report the bugs, we said that they were from 3.31 version, but people in mitre changed them to 3.30.1. We just reported what we found. And the commit we reported in the bug report is referencing to the official GitHub repo. Of course the people

Re: [sqlite] CVE-2019-19317

2019-12-14 Thread Simon Slavin
On 14 Dec 2019, at 11:16pm, Yongheng Chen wrote: > When we report the bugs, we said that they were from 3.31 version, but people > in mitre changed them to 3.30.1. We just reported what we found. And the > commit we reported in the bug report is referencing to the official GitHub > repo. > >

Re: [sqlite] CVE-2019-19317

2019-12-14 Thread Yongheng Chen
When we report the bugs, we said that they were from 3.31 version, but people in mitre changed them to 3.30.1. We just reported what we found. And the commit we reported in the bug report is referencing to the official GitHub repo. Bugs are found in the latest version, because there are so many

Re: [sqlite] CVE-2019-19317

2019-12-14 Thread Richard Hipp
On 12/14/19, Raitses, Alex wrote: > Hello, > CVE-2019-19317 (https://nvd.nist.gov/vuln/detail/CVE-2019-19317) was > submitted on SQLite. > As far as I can see the patch is already submitted. Can you confirm please? > Do you have estimation for the fixed version release? This CVE appears to refer

Re: [sqlite] CVE-2019-19317

2019-12-14 Thread Shawn Wagner
Addendum: I suspect it's the one mentioned as being filed in this earlier thread: https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg117794.html On Sat, Dec 14, 2019, 2:12 PM Shawn Wagner wrote: > This appears to be a CVE pertaining to a feature that hasn't even been > release

Re: [sqlite] CVE-2019-19317

2019-12-14 Thread Shawn Wagner
This appears to be a CVE pertaining to a feature that hasn't even been released yet (generated columns will be in the upcoming 3.31; they're certainly not in the referenced 3.30.1). Unless you're using the development snapshot from the download page or following trunk on fossil and haven't updated

[sqlite] CVE-2019-19317

2019-12-14 Thread Raitses, Alex
Hello, CVE-2019-19317 (https://nvd.nist.gov/vuln/detail/CVE-2019-19317) was submitted on SQLite. As far as I can see the patch is already submitted. Can you confirm please? Do you have estimation for the fixed version release? Thanks in advance, Regards, Alex ---