--- id: CVE-2020-13631 title: >- SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c. summary: >- SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c. severity: medium cvss: 5.5 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N' vendor: sqlite product: sqlite affected: - sqlite < 3.32.0 - fedora = 32 - ubuntu_linux = 16.04 - ubuntu_linux = 18.04 - ubuntu_linux = 19.10 - ubuntu_linux = 20.04 - cloud_backup - 'solidfire,_enterprise_sds_&_hci_storage_node' - fabric_operating_system - hci_compute_node_firmware - sinec_infrastructure_network_services < 1.0.1.1 - icloud < 11.5 - itunes < 12.10.9 - ipados < 14.0 - iphone_os < 14.0 - macos < 11.0.1 - tvos < 14.0 - watchos < 7.0 - 'communications_network_charging_and_control >= 12.0.0, <= 12.0.3' - communications_network_charging_and_control = 6.0.1 - outside_in_technology = 8.5.4 - outside_in_technology = 8.5.5 - zfs_storage_appliance_kit = 8.8 patched: - sqlite 3.32.0 - sinec_infrastructure_network_services 1.0.1.1 - icloud 11.5 - itunes 12.10.9 - ipados 14.0 - iphone_os 14.0 - macos 11.0.1 - tvos 14.0 - watchos 7.0 published: '2020-05-27' updated: '2026-10-14' sourceUpdated: '2026-10-14T10:17:27.850' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-13631' references: - url: 'http://seclists.org/fulldisclosure/2020/Dec/32' label: cve@mitre.org - url: 'http://seclists.org/fulldisclosure/2020/Nov/19' label: cve@mitre.org - url: 'http://seclists.org/fulldisclosure/2020/Nov/20' label: cve@mitre.org - url: 'http://seclists.org/fulldisclosure/2020/Nov/22' label: cve@mitre.org - url: 'https://bugs.chromium.org/p/chromium/issues/detail?id=1080459' label: cve@mitre.org - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf' label: cve@mitre.org - url: >- https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7KXQWHIY2MQP4LNM6ODWJENMXYYQYBN/ label: cve@mitre.org - url: 'https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc' label: cve@mitre.org - url: 'https://security.gentoo.org/glsa/202007-26' label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20200608-0002/' label: cve@mitre.org - url: 'https://sqlite.org/src/info/eca0ba2cf4c0fdf7' label: cve@mitre.org - url: 'https://support.apple.com/kb/HT211843' label: cve@mitre.org - url: 'https://support.apple.com/kb/HT211844' label: cve@mitre.org - url: 'https://support.apple.com/kb/HT211850' label: cve@mitre.org - url: 'https://support.apple.com/kb/HT211931' label: cve@mitre.org - url: 'https://support.apple.com/kb/HT211935' label: cve@mitre.org - url: 'https://support.apple.com/kb/HT211952' label: cve@mitre.org - url: 'https://usn.ubuntu.com/4394-1/' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujul2020.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html' label: cve@mitre.org - url: 'http://seclists.org/fulldisclosure/2020/Dec/32' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://seclists.org/fulldisclosure/2020/Nov/19' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://seclists.org/fulldisclosure/2020/Nov/20' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://seclists.org/fulldisclosure/2020/Nov/22' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://bugs.chromium.org/p/chromium/issues/detail?id=1080459' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7KXQWHIY2MQP4LNM6ODWJENMXYYQYBN/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202007-26' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20200608-0002/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://sqlite.org/src/info/eca0ba2cf4c0fdf7' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT211843' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT211844' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT211850' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT211931' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT211935' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT211952' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/4394-1/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujul2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-389290.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-13631.json - url: 'https://access.redhat.com/security/cve/CVE-2020-13631' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1841568' - url: 'https://www.cve.org/CVERecord?id=CVE-2020-13631' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-13631' - url: 'https://access.redhat.com/errata/RHSA-2020:4442' - url: 'https://access.redhat.com/errata/RHSA-2021:1968' - url: 'https://access.redhat.com/errata/RHSA-2025:16504' tags: - nvd - csaf - vex - red-hat epss: 0.0062 epssPercentile: 0.48299 ingestedAt: '2026-10-13T18:41:42.716Z' cwe: - CWE-20 --- ## Overview SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c. ## Affected - `sqlite < 3.32.0` - `fedora = 32` - `ubuntu_linux = 16.04` - `ubuntu_linux = 18.04` - `ubuntu_linux = 19.10` - `ubuntu_linux = 20.04` - `cloud_backup` - `solidfire,_enterprise_sds_&_hci_storage_node` - `fabric_operating_system` - `hci_compute_node_firmware` - `sinec_infrastructure_network_services < 1.0.1.1` - `icloud < 11.5` - `itunes < 12.10.9` - `ipados < 14.0` - `iphone_os < 14.0` - `macos < 11.0.1` - `tvos < 14.0` - `watchos < 7.0` - `communications_network_charging_and_control >= 12.0.0, <= 12.0.3` - `communications_network_charging_and_control = 6.0.1` - `outside_in_technology = 8.5.4` - `outside_in_technology = 8.5.5` - `zfs_storage_appliance_kit = 8.8` ## Remediation Upgrade past the affected range: - `sqlite 3.32.0` - `sinec_infrastructure_network_services 1.0.1.1` - `icloud 11.5` - `itunes 12.10.9` - `ipados 14.0` - `iphone_os 14.0` - `macos 11.0.1` - `tvos 14.0` - `watchos 7.0` ## Vendor advisories - **RHSA-2020:4442** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8) · released 2020-11-04 · [advisory](https://access.redhat.com/errata/RHSA-2020:4442) - **RHSA-2021:1968** · Red Hat · fixed in: Red Hat CodeReady Linux Builder (v. 8) · released 2021-05-18 · [advisory](https://access.redhat.com/errata/RHSA-2021:1968) - **RHSA-2025:16504** · Red Hat · fixed in: Red Hat Openshift Data Foundation 4.19 · released 2025-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2025:16504) - **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · updated 2026-10-13 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-13631.json)