google / google/security-research
Is GHSA-v2c8-vqqp-hv3g applicable back to sqlite 3.43.0 (instead of 3.49.1)?
Open
- Dominant language
- C
- Stars
- 4.6k
- Forks
- 582
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 3
Description
Why is the security advisory at [GHSA-v2c8-vqqp-hv3g](https://github.com/google/security-research/security/advisories/GHSA-v2c8-vqqp-hv3g) showing a lower version bound for sqlite at 3.49.1?
Looking back in history, the vulnerable code exists before 3.49.1 (I see fts5SegIterAllocTombstone() and fts5MultiIterIsDeleted() back to 3.43.0).
I may not have looked deep enough, but could you please explain the rationale for the lower bound of 3.49.1 in the advisory?
Contributor guide
Assessment
This issue has not been assessed yet.