CVE-2020-11655

Name of the Vulnerable Software and Affected Versions SQLite versions through 3.31.1

Description The issue allows attackers to cause a denial of service, resulting in a segmentation fault, via a malformed window-function query. This is due to the mishandling of the AggInfo object's initialization. The vulnerability is related to a lack of input validation in the resetAccumulator function from src/select.c, which can be exploited by a remote attacker to cause a denial of service.

Recommendations For versions through 3.31.1, consider disabling the use of window-function queries until a patch is available. As a temporary workaround, restrict the input to the resetAccumulator function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.