CVE-2022-35737
HighAdvisory
Published 3 Aug 2022In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.215
- 97th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 473
- of 17,781 indexed, latest versions
- Container images
- 413
- deployed by those charts
- Fix available
- 4 of 4
- affected packages
`libsqlite3-sys` via C SQLite improperly validates array index
Carried by container images the latest versions of 473 of 17,781 indexed charts deploy, on 413 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| sqlite3deb | 3.8.2-1ubuntu2, 3.8.2-1ubuntu2.1, 3.8.2-1ubuntu2.2, 3.11.0-1ubuntu1+15 more | 3.8.2-1ubuntu2.2+esm3, 3.11.0-1ubuntu1.5+esm2, 3.22.0-1ubuntu0.7, 3.31.1-4ubuntu0.5+1 more | 291 |
| libsqlite3-syscargo | 0.23.2 | 0.25.1 | 1 |
| sqliterpm | 3.26.0-3.el8, 3.26.0-4.el8_1, 3.26.0-6.el8, 3.26.0-11.el8+5 more | 0:3.26.0-17.el8_7, 0:3.34.1-6.el9_1 | 119 |
| sqlite3rpm | 3.28.0-lp151.2.3.1 | 3.39.2-1.1 | 2 |
- OSV records
- GHSA-jw36-hf63-69r9UBUNTU-CVE-2022-35737RHSA-2023:0110RHSA-2023:0339openSUSE-SU-2024:12210-1
- Also known as
- BIT-sqlite-2022-35737, RUSTSEC-2022-0090, USN-5712-1, USN-5716-1, USN-5716-2
Charts affected
473 by stars
Container images carrying it
413 by charts deploying them
A fixed version is listed for 4 of the 4 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | 9b6105be7ad0 | sqlite3 | 3.31.1-4ubuntu0.5 | 2 |
| ghcr.io/ | 4ee0764310e7 | sqlite3 | 3.22.0-1ubuntu0.7 | 2 |
| quay.io/ | 68f9f38c8f30 | sqlite | 0:3.26.0-17.el8_7 | 2 |
| quay.io/ | d8c631a6dc43 | sqlite | 0:3.26.0-17.el8_7 | 2 |
| quay.io/ | 464a3af4dfe0 | sqlite | 0:3.26.0-17.el8_7 | 2 |
| quay.io/ | bb5e052770e5 | sqlite | 0:3.26.0-17.el8_7 | 2 |
| a10networks/ | 8dc58d434d71 | sqlite3 | 3.22.0-1ubuntu0.7 | 1 |
| adwerx/ | 840d2b078682 | sqlite3 | 3.31.1-4ubuntu0.5 | 1 |
| airsonicadvanced/ | f7cbafac2806 | sqlite3 | 3.31.1-4ubuntu0.5 | 1 |
| allegroai/ | 772827a01bb5 | sqlite3 | 3.22.0-1ubuntu0.7 | 1 |
| anchore/ | bde9eedf639d | sqlite | 0:3.26.0-17.el8_7 | 1 |
| anchore/ | ed9b3badd17c | sqlite | 0:3.26.0-17.el8_7 | 1 |
| apache/ | 3bb13d14f64a | sqlite | 0:3.26.0-17.el8_7 | 1 |
| apache/ | afa47bf1692a | sqlite3 | 3.31.1-4ubuntu0.5 | 1 |
| apachepulsar/ | 3b262ab7a7d9 | sqlite3 | 3.31.1-4ubuntu0.5 | 1 |
| apachepulsar/ | d056c89b7131 | sqlite3 | 3.31.1-4ubuntu0.5 | 1 |
| apachepulsar/ | d538416d5afe | sqlite3 | 3.31.1-4ubuntu0.5 | 1 |
| apache/ | b4ec8c18d079 | sqlite3 | 3.31.1-4ubuntu0.5 | 1 |
| apache/ | 80530f0308a5 | sqlite3 | 3.31.1-4ubuntu0.5 | 1 |
| apicurio/ | a97d67487532 | sqlite | 0:3.26.0-17.el8_7 | 1 |
| assistiot/ | d157fbe150e3 | sqlite3 | 3.31.1-4ubuntu0.5 | 1 |
| assistiot/ | 0df4b4fa899a | sqlite | 0:3.26.0-17.el8_7 | 1 |
| bbernhard/ | 549ad08d7e14 | sqlite3 | 3.31.1-4ubuntu0.5 | 1 |
| blakeblackshear/ | ae269270ad9e | sqlite3 | 3.31.1-4ubuntu0.5 | 1 |
| browserless/ | c81ae5585b47 | sqlite3 | 3.31.1-4ubuntu0.5 | 1 |
| bsgrigorov/ | 45ab095f09c8 | sqlite | 0:3.26.0-17.el8_7 | 1 |
| cfcontainerization/ | 82fa261c18a8 | sqlite3 | 3.39.2-1.1 | 1 |
| cfcontainerization/ | 58fb1c173a46 | sqlite3 | 3.39.2-1.1 | 1 |
| chetangautamm/ | b4b94155ff5a | sqlite3 | 3.8.2-1ubuntu2.2+esm3 | 1 |
| chetangautamm/ | e7f7049e1544 | sqlite3 | 3.31.1-4ubuntu0.5 | 1 |
| cheyang/ | 46cc34755493 | sqlite3 | 3.11.0-1ubuntu1.5+esm2 | 1 |
| citizenstig/ | b81c818ccb86 | sqlite3 | 3.11.0-1ubuntu1.5+esm2 | 1 |
| cloudve/ | af56e77ca587 | sqlite3 | 3.22.0-1ubuntu0.7 | 1 |
| cloudve/ | d79c1c5881c0 | sqlite3 | 3.22.0-1ubuntu0.7 | 1 |
| cockroachdb/ | 983312754620 | sqlite | 0:3.26.0-17.el8_7 | 1 |
| confluentinc/ | f2975d507a2a | sqlite | 0:3.26.0-17.el8_7 | 1 |
| confluentinc/ | 8f1544df1f48 | sqlite | 0:3.26.0-17.el8_7 | 1 |
| confluentinc/ | 3bf359d5e340 | sqlite | 0:3.26.0-17.el8_7 | 1 |
| confluentinc/ | 4bc70a83ca6f | sqlite | 0:3.26.0-17.el8_7 | 1 |
| confluentinc/ | b0b7aa26254a | sqlite | 0:3.26.0-17.el8_7 | 1 |
| confluentinc/ | ee403d5b9090 | sqlite | 0:3.26.0-17.el8_7 | 1 |
| confluentinc/ | b651d4b6185a | sqlite | 0:3.26.0-17.el8_7 | 1 |
| confluentinc/ | 78c190f4472c | sqlite | 0:3.26.0-17.el8_7 | 1 |
| craftypath/ | 402a0024c732 | sqlite | 0:3.26.0-17.el8_7 | 1 |
| cribl/ | 762747cb6796 | sqlite3 | 3.22.0-1ubuntu0.7 | 1 |
| csiplugin/ | 1fa83d45417f | sqlite3 | 3.11.0-1ubuntu1.5+esm2 | 1 |
| ctron/ | 8fdea8f76499 | sqlite | 0:3.26.0-17.el8_7 | 1 |
| daskdev/ | 052630f5ca04 | sqlite3 | 3.22.0-1ubuntu0.7 | 1 |
| datadog/ | 513a4377aed5 | sqlite | 0:3.26.0-17.el8_7 | 1 |
| datalust/ | 9c731bb207a6 | sqlite3 | 3.11.0-1ubuntu1.5+esm2 | 1 |