CVE catalog

CVE-2023-32697

xerial-sqlite-jdbc: CVE-2023-32697

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.59% · Oct 25, 2026

SQLite JDBC is a library for accessing and creating SQLite database files in Java. Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL. This issue impacting versions 3.6.14.1 through 3.41.2.1 and has been fixed in version 3.41.2.2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianxerial-sqlite-jdbcsid3.53.2.1+dfsg-1fixed
Debianxerial-sqlite-jdbcforky3.53.2.1+dfsg-1fixed
Debianxerial-sqlite-jdbctrixie3.46.1.3+dfsg-1fixed
Debianxerial-sqlite-jdbcbookworm3.40.1.0+dfsg-1+deb12u1fixed
Ubuntuxerial-sqlite-jdbc22.043.36.0.3+dfsg1-1vulnerable
Ubuntuxerial-sqlite-jdbc22.043.36.0.3+dfsg1-2vulnerable
Ubuntuxerial-sqlite-jdbc22.043.36.0.3+dfsg1-3vulnerable
Ubuntuxerial-sqlite-jdbc24.043.42.0.0+dfsg-1vulnerable
Ubuntuxerial-sqlite-jdbc24.043.44.1.0+dfsg-1vulnerable
Ubuntuxerial-sqlite-jdbc24.043.44.1.0+dfsg-1build1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianxerial-sqlite-jdbcsourcesid3.42.0.0+dfsg-1not yet assignedNot reported[1036706]
Debianxerial-sqlite-jdbcsourceforky3.42.0.0+dfsg-1not yet assignedNot reported[1036706]
Debianxerial-sqlite-jdbcsourcetrixie3.42.0.0+dfsg-1not yet assignedNot reported[1036706]
Debianxerial-sqlite-jdbcsourcebookworm3.40.1.0+dfsg-1+deb12u1not yet assignedNot reported[1036706]

[Debian bug #1036706]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]