3 Critical CVE's in radarr container

[Sloth-on-meth]

Is there an existing issue for this?

• [X] I have searched the existing issues

Current Behavior

---

In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement. CVE-2020-11656 https://www.oracle.com/security-alerts/cpuoct2020.html /app/radarr/bin/System.Data.SQLite.dll

---

pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns. CVE-2019-19646 https://security.netapp.com/advisory/ntap-20191223-0001/ /app/radarr/bin/System.Data.SQLite.dll

---

The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact. CVE-2017-10989 https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1700937 /app/radarr/bin/System.Data.SQLite.dll

---

Expected Behavior

N/A

Steps To Reproduce

N/A

Environment

- OS: UBUNTU
- Radarr: 3.2.2.5080
- Docker Install: YES
- Using Reverse Proxy: N/A
- Browser: N/A

What branch are you running?

Master

Trace Logs?

N/A

AB#2146

[Sloth-on-meth]

copied from https://github.com/Radarr/Radarr/issues/6814

[github-actions[bot]]

Thanks for opening your first issue here! Be sure to follow the bug or feature issue templates!

[Roxedus]

This is not a container issue either. This would have to be solved by the package maintainers for the SQLite package in Ubuntu.