Security Bulletin: A security vulnerability has been identified in SQLite shipped with PowerAI.

Summary

Multiple vulnerabilities CVE-2019-19959 and CVE-2019-20218 found in SQLite package.

Vulnerability Details

CVEID:CVE-2019-19959
**DESCRIPTION:**SQLite is vulnerable to a denial of service in situations when INSERT INTO is used and there are embedded ‘\0’ characters in file names. By using a specially-crafted file name, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/174011 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2019-20218
**DESCRIPTION:**An unspecified error in selectExpander in select.c in SQLite has an unknown impact and attack vector.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/173900 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Affected Products and Versions

Remediation/Fixes

For IBM PowerAI 1.6.0 and Watson Machine Learning Community Edition 1.6.1 :

Upgrade to WML CE 1.6.2, which includes the fixes. See https://www.ibm.com/support/knowledgecenter/SS5SF7 for upgrading instructions.

For Watson Machine Learning Community Edition 1.6.2 :

For installing WML CE from scratch

New installations of WML CE include all security fixes.

See https://www.ibm.com/support/knowledgecenter/SS5SF7 for installation instructions.

Updating an existing WML CE installation

It is recommended to keep packages up to date. To update all packages to the latest versions within 1.6.2 use:

echo “powerai-release=1.6.2” >> $CONDA_PREFIX/conda-meta/pinned

conda update --all

To update individual packages, use the package name:

conda update tensorflow

Alternatively, the WML CE installation can be upgraded to 1.7.0, which also contains the fix.

conda update --all

Workarounds and Mitigations

None