WaratekVRT Sign in

CVE-2019-19646 SQLite

Affected softwareSQLite
Severity9.8 Critical CVSS 3.1 2 scores
WeaknessCWE-754
Published9 Dec 2019
Updated14 Oct 2026

Description

pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 6 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 7.4% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2020 ↗ CPU 2020-Q2 Oracle MySQL / MySQL Workbench (SQLite) (8.0.19 and prior)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle MySQL MySQL Workbench (SQLite) 8.0.19 and prior

Products and versions

6 products, 6 version entries
SourceVendorProductSchemeAffected versions
nvd netapp cloud backup generic any version
nvd netapp ontap select deploy administration utility generic any version
nvd oracle mysql workbench generic ≤ 8.0.19
nvd siemens sinec infrastructure network services generic ＜ 1.0.1.1
nvd sqlite sqlite generic ≤ 3.30.1
nvd tenable tenable.sc generic ＜ 5.19.0

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** MYSQL WORKBENCH, NO AUTH REMOTE EXPLOIT, MYSQL WORKBENCH (SQLITE) **Products:** MYSQL WORKBENCH, SQLITE, ORACLE MYSQL

References

URLTags
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf Patch, Third Party Advisory
https://github.com/sqlite/sqlite/commit/926f796e8feec15f3836aa0a060ed906f8ae04d3 Third Party Advisory
https://github.com/sqlite/sqlite/commit/ebd70eedd5d6e6a890a670b5ee874a5eae86b4dd Patch, Third Party Advisory
https://security.netapp.com/advisory/ntap-20191223-0001/ Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html Patch, Third Party Advisory
https://www.sqlite.org/ Vendor Advisory
https://www.tenable.com/security/tns-2021-14 Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-389290.html
https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Timeline
Published2019-12-09By the CVE Program.
NVD record modified2026-10-14NVD's own last-modified date for this record.