1 High and 1 Medium vulnerabilities detected when using an automatic vulnerability-detection tool #29
Description
Context where the vulnerabilities are detected
Steps to reproduce:
Create a Hello World application importing xeodou/go-sqlcipher
Build the application
Scan the result with Black Duck Binary Analysis
Expected behavior:
No vulnerablities should be reported.
Actual behavior:
1 High and 1 Medium vulnerabilities are detected.
More details on the vulnerabilities:
High (CVE-2021-3119)
Zetetic SQLCipher 4.x before 4.4.3 has a NULL pointer dereferencing issue related to sqlcipher_export in crypto.c and sqlite3StrICmp in sqlite3.c. This may allow an attacker to perform a remote denial of service attack. For example, an SQL injection can be used to execute the crafted SQL command sequence, which causes a segmentation fault.
Medium (CVE-2020-27207)
Zetetic SQLCipher 4.x before 4.4.1 has a use-after-free, related to sqlcipher_codec_pragma and sqlite3Strlen30 in sqlite3.c. A remote denial of service attack can be performed. For example, a SQL injection can be used to execute the crafted SQL command sequence. After that, some unexpected RAM data is read.
Additional details
I know that you are not responsible, technically speaking,of the SQLCipher from Zetetic. I am just afraid that you are wrapping in Go, an outdated version of SQLCipher.