--- id: CVE-2020-11655 title: >- SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled. summary: >- SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled. severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-665 vendor: sqlite product: sqlite affected: - sqlite <= 3.31.1 - ontap_select_deploy_administration_utility - debian_linux = 8.0 - debian_linux = 9.0 - ubuntu_linux = 16.04 - ubuntu_linux = 18.04 - ubuntu_linux = 19.10 - ubuntu_linux = 20.04 - 'communications_element_manager >= 8.2.0, <= 8.2.2' - 'communications_network_charging_and_control >= 12.0.0, <= 12.0.3' - communications_network_charging_and_control = 6.0.1 - communications_network_charging_and_control = 12.0.2 - 'communications_session_report_manager >= 8.2.0, <= 8.2.2' - 'communications_session_route_manager >= 8.2.0, <= 8.2.2' - enterprise_manager_ops_center = 12.4.0.0 - hyperion_infrastructure_technology = 11.1.2.4 - instantis_enterprisetrack = 17.1 - instantis_enterprisetrack = 17.2 - instantis_enterprisetrack = 17.3 - 'mysql >= 8.0.0, <= 8.0.22' - mysql_workbench <= 8.0.22 - outside_in_technology = 8.5.4 - outside_in_technology = 8.5.5 - zfs_storage_appliance_kit = 8.8 - communications_messaging_server = 8.1 - sinec_infrastructure_network_services < 1.0.1.1 - tenable.sc < 5.19.0 patched: - sinec_infrastructure_network_services 1.0.1.1 - tenable.sc 5.19.0 published: '2020-04-09' updated: '2026-10-14' sourceUpdated: '2026-10-14T09:17:18.097' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-11655' references: - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2020/05/msg00006.html' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html' label: cve@mitre.org - url: 'https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc' label: cve@mitre.org - url: 'https://security.gentoo.org/glsa/202007-26' label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20200416-0001/' label: cve@mitre.org - url: 'https://usn.ubuntu.com/4394-1/' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujan2021.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujul2020.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html' label: cve@mitre.org - url: 'https://www.tenable.com/security/tns-2021-14' label: cve@mitre.org - url: 'https://www3.sqlite.org/cgi/src/info/4a302b42c7bf5e11' label: cve@mitre.org - url: 'https://www3.sqlite.org/cgi/src/tktview?name=af4556bb5c' label: cve@mitre.org - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2020/05/msg00006.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202007-26' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20200416-0001/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/4394-1/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujul2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.tenable.com/security/tns-2021-14' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www3.sqlite.org/cgi/src/info/4a302b42c7bf5e11' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www3.sqlite.org/cgi/src/tktview?name=af4556bb5c' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-389290.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e tags: - nvd epss: 0.0434 epssPercentile: 0.90998 ingestedAt: '2026-10-14T09:24:26.055Z' --- ## Overview SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled. ## Affected - `sqlite <= 3.31.1` - `ontap_select_deploy_administration_utility` - `debian_linux = 8.0` - `debian_linux = 9.0` - `ubuntu_linux = 16.04` - `ubuntu_linux = 18.04` - `ubuntu_linux = 19.10` - `ubuntu_linux = 20.04` - `communications_element_manager >= 8.2.0, <= 8.2.2` - `communications_network_charging_and_control >= 12.0.0, <= 12.0.3` - `communications_network_charging_and_control = 6.0.1` - `communications_network_charging_and_control = 12.0.2` - `communications_session_report_manager >= 8.2.0, <= 8.2.2` - `communications_session_route_manager >= 8.2.0, <= 8.2.2` - `enterprise_manager_ops_center = 12.4.0.0` - `hyperion_infrastructure_technology = 11.1.2.4` - `instantis_enterprisetrack = 17.1` - `instantis_enterprisetrack = 17.2` - `instantis_enterprisetrack = 17.3` - `mysql >= 8.0.0, <= 8.0.22` - `mysql_workbench <= 8.0.22` - `outside_in_technology = 8.5.4` - `outside_in_technology = 8.5.5` - `zfs_storage_appliance_kit = 8.8` - `communications_messaging_server = 8.1` - `sinec_infrastructure_network_services < 1.0.1.1` - `tenable.sc < 5.19.0` ## Remediation Upgrade past the affected range: - `sinec_infrastructure_network_services 1.0.1.1` - `tenable.sc 5.19.0`