CVE-2020-11655

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-04-09 · updated 2026-10-14
Weakness: CWE-665

Description

SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.

Affected products

Canonical Ubuntu Linux: 16.04, 18.04, 19.10, 20.04
Debian Linux: 8.0, 9.0
NetApp ONTAP Select Deploy administration utility: all versions
Oracle Communications Element Manager: from 8.2.0 through 8.2.2
Oracle Communications Messaging Server: 8.1
Oracle Communications Network Charging And Control: from 12.0.0 through 12.0.3; 6.0.1, 12.0.2
Oracle Communications Session Report Manager: from 8.2.0 through 8.2.2
Oracle Communications Session Route Manager: from 8.2.0 through 8.2.2
Oracle Corporation Enterprise Manager Ops Center: 12.4.0.0
Oracle Corporation Oracle Hyperion Infrastructure Technology: 11.1.2.4
Oracle Instantis Enterprisetrack: 17.1, 17.2, 17.3
MySQL Server: from 8.0.0 through 8.0.22
Oracle Corporation MySQL Workbench: through 8.0.22
Oracle Corporation Outside In Technology: 8.5.4, 8.5.5
Oracle Corporation Oracle ZFS Storage Appliance Kit: 8.8
Siemens Sinec Infrastructure Network Services: before 1.0.1.1 — fixed in 1.0.1.1
SQLite: through 3.31.1
Tenable.sc: before 5.19.0 — fixed in 5.19.0

How to fix

Upgrade to a fixed version: Siemens Sinec Infrastructure Network Services 1.0.1.1; Tenable.sc 5.19.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-11655 or the next vulnerability affects your stack