[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
sqlite3 (changelog)	2.9.5 → 2.9.6

---

sqlite3-ruby: Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array

GHSA-mwm8-39rw-8826

More information

Details

Summary

Using Database#create_aggregate, #create_aggregate_handler, or Database#define_aggregator to define an aggregate function that takes two or more arguments, and then evaluating it over TEXT or BLOB column values, can free the Ruby objects holding those arguments while a later argument is still being converted, during ordinary garbage collection. The aggregate's step method then receives an incorrect object, or the process crashes with a segmentation fault.

Mitigation

Upgrade to sqlite3 gem v2.9.6 or later.

There is no reliable workaround. If you cannot upgrade, avoid defining aggregate functions that take two or more arguments. Restricting column value sizes is not a mitigation: smaller values make the defect fire less often but do not prevent it.

Severity

The sqlite3-ruby maintainers assess this as Medium severity (CVSS 4.0 score 6.3). It is reached through ordinary garbage collection without any unusual code structuring: an application is exposed whenever it evaluates a multi-argument aggregate over TEXT or BLOB values whose size an attacker can influence. The demonstrated impact is an incorrect value passed to the aggregate's step method, or a process crash; no controlled memory write or general denial-of-service exploit has been demonstrated.

Credits

Reported by Jeremy Daer (@​jeremy).

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-mwm8-39rw-8826
• https://github.com/sparklemotion/sqlite3-ruby/pull/733
• https://github.com/sparklemotion/sqlite3-ruby/commit/cc5ac0cdf05af8148f4363410da0ba32508d9c97
• https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.9.6
• https://github.com/advisories/GHSA-mwm8-39rw-8826

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

sparklemotion/sqlite3-ruby (sqlite3)

v2.9.6

Compare Source

Security / Stability

• Fix a garbage collection bug where the argument array passed to a custom aggregate function's step was not visible to the GC, so arguments could be collected mid-conversion when the aggregate takes two or more arguments, corrupting the values passed to step or crashing the process. See GHSA-mwm8-39rw-8826 for more information. #​733 @​jeremy

Fixed

• Fix a leak where custom aggregate handler instances were never released, so a connection accumulated one instance per GROUP BY group per query for its lifetime. #​722 @​djmb
• Fix GC compaction issues with custom functions, aggregates, collations, #trace and #authorizer=. These callbacks were registered with sqlite by passing a raw Ruby object pointer as user data; keeping the object reachable prevented collection but not relocation, after which sqlite held a stale address and the next call could raise NoMethodError, return a wrong result, or segfault. Affects applications that call GC.compact or run with GC.auto_compact = true. The equivalent issue in #busy_handler was fixed in #​466. #​723 @​djmb
• Fix the private methods Database#open_v2 and #open16 silently replacing a live connection and leaking the previous connection handle when invoked via send on an open database. They now raise SQLite3::Exception. #​729 @​flavorjones
• Fix TEXT values containing an embedded NUL byte being truncated at the first NUL when passed as arguments to functions created with Database#define_function. #​730 @​flavorjones
• Fix an exception raised inside a Database#define_function block leaving the connection's sqlite mutex held, which deadlocked any other thread that later used the connection. The exception now propagates to the caller and the connection remains usable. #​731 @​flavorjones
• Database.new now raises ArgumentError when the filename or VFS name contains an embedded NUL byte (or an embedded 0x0000 code unit in a UTF-16 filename), instead of silently opening a path truncated at the NUL. #​732 @​flavorjones

Improved

• When Database.new fails to open the database file, the underlying sqlite3 connection handle is now closed immediately instead of waiting for the garbage collector to clean it up. #​719 @​katafrakt

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.