Kotsi ho SQLite e lumellang litlhaselo tse hole ho Chrome ka WebSQL

Bafuputsi ba ts'ireletso ba k'hamphani ea Chaena ea Tencent hlahisoa mofuta o mocha oa ts'oaetso Magellan (CVE-2019-13734), e u lumellang hore u fihlele ts'ebetso ea khoutu ha u sebetsana le SQL constructs e entsoeng ka tsela e itseng ho SQLite DBMS. Ho ne ho e-na le ts'oaetso e tšoanang phatlalalitsoe ke bafuputsi ba tšoanang selemo se fetileng. Ho ba kotsing hoa hlokomeleha ka hore ho lumella motho ho hlasela sebatli sa Chrome a le hole le ho fihlela taolo holim'a sistimi ea mosebelisi ha a bula maqephe a webo a laoloang ke mohlaseli.

Tlhaselo ea Chrome/Chromium e etsoa ka WebSQL API, e sebetsanang le eona e ipapisitse le khoutu ea SQLite. Ho hlaseloa ha likopo tse ling ho ka khoneha feela haeba ba lumella ho fetisoa ha SQL constructs ho tsoa ka ntle ho SQLite, mohlala, ba sebelisa SQLite e le mokhoa oa ho fapanyetsana data. Firefox ha e kotsing hobane Mozilla hana ho tsoa ts'ebetsong ea WebSQL molemo IndexedDB API.

Google e lokisitse bothata ha e lokolloa Chrome 79. Ho bile le bothata ho SQLite codebase tsitsitseng November 17, le ho Chromium codebase - 21 November.
Bothata bo teng ho khoutu Enjene ea ho batla ea mongolo o felletseng ea FTS3 le ka ho qhekella litafole tsa moriti (mofuta o ikhethileng oa tafole e nang le ho ngoloa) e ka lebisa ho bobolu ba index le buffer overflow. Lintlha tse felletseng mabapi le mekhoa ea ts'ebetso li tla phatlalatsoa kamora matsatsi a 90.

Tokollo e ncha ea SQLite e nang le tokiso hajoale ha e boptjoe (lebelletsoe ho La 31 Tšitoe). E le ts'ebetso ea ts'ireletso, ho qala ka SQLite 3.26.0, mokhoa oa SQLite_DBCONFIG_DEFENSIVE o ka sebelisoa, o thibelang ho ngolla litafole tsa moriti 'me o khothaletsoa hore o kenyelelitsoe ha o sebetsana le lipotso tsa ka ntle tsa SQL ho SQLite. Ho lisebelisoa tsa kabo, ho ba kotsing ho laeborari ea SQLite ho lula ho sa tsejoe Debian, Botho, RHEL, bulaSUSE / SUSE, Arch Linux, Fedora, FreeBSD. Chromium liphatlalatsong tsohle e se e nchafalitsoe ebile ha e amehe ke tlokotsi, empa bothata bo ka ama libatli le lits'ebetso tse fapaneng tse sebelisang enjine ea Chromium, hammoho le lits'ebetso tsa Android tse thehiloeng ho Webview.

Ho feta moo, mathata a 4 a seng kotsi haholo a boetse a bonoa ho SQLite (CVE-2019-13750, CVE-2019-13751, CVE-2019-13752, CVE-2019-13753), e ka lebisang ho phatloheng ha tlhahisoleseling le ho qoba lithibelo (e ka sebelisoa e le lintlha tse tlatsetsang bakeng sa tlhaselo ea Chrome). Litaba tsena li ile tsa lokisoa ka khoutu ea SQLite ka la 13 Tšitoe. Ha li kopane, mathata a ile a lumella bafuputsi hore ba lokisetse ts'ebetsong e lumellang hore khoutu e phethoe maemong a ts'ebetso ea Chromium e ikarabellang bakeng sa ho fana.

Source: opennet.ru