cve/2019/CVE-2019-19923.md

CVE-2019-19923

Description

flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results).

POC

Reference

• 396afe6f6a
• https://www.oracle.com/security-alerts/cpuapr2020.html

Github

• https://github.com/garethr/snykout