CVE-2020-11656

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-04-09 · updated 2026-10-14
Weakness: CWE-416

Description

In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.

Affected products

NetApp ONTAP Select Deploy administration utility: all versions
Oracle Communications Messaging Server: 8.1
Oracle Communications Network Charging And Control: from 12.0.0 through 12.0.3; 6.0.1, 12.0.2
Oracle Corporation Enterprise Manager Ops Center: 12.4.0.0
Oracle Corporation Oracle Hyperion Infrastructure Technology: 11.1.2.4
MySQL Server: from 8.0.0 through 8.0.22
Oracle Corporation MySQL Workbench: through 8.0.22
Oracle Corporation Outside In Technology: 8.5.4, 8.5.5
Oracle Corporation Oracle ZFS Storage Appliance Kit: 8.8
Siemens Sinec Infrastructure Network Services: before 1.0.1.1 — fixed in 1.0.1.1
SQLite: through 3.31.1
Tenable.sc: through 5.19.0

How to fix

Upgrade to a fixed version: Siemens Sinec Infrastructure Network Services 1.0.1.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-11656 or the next vulnerability affects your stack