CVE-2022-35737: netapp ontap_select_deploy_administration_utility Improper Validation of Array Index
CVSS: 7.5v3.1HighModified
AliasesALPINE-CVE-2022-35737MGASA-2022-0273RHSA-2023:0110RHSA-2023:0339UBUNTU-CVE-2022-35737USN-5712-1USN-5716-1USN-5716-2DEBIAN-CVE-2022-35737openSUSE-SU-2024:12210-1GHSA-jw36-hf63-69r9BIT-sqlite-2022-35737RUSTSEC-2022-0090
Published 03-08-2022Last modified 14-10-2026
Vulnerability summary
CVE-2022-35737 is a high (CVSS 7.5) Improper Validation of Array Index vulnerability in netapp ontap_select_deploy_administration_utility. EPSS estimates a 23.25% chance of exploitation in the next 30 days, higher than 97.7% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
23.25%
0%100%
High · +1.80 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 4 · Related 3Timeline
- 03-08-2022PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSources7 sources · 5.9–7.5
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · Red hatEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · Crates.ioEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
23.25%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
+1.80 pp
From 21.45% on 19-09-2026
19-09-202619-10-2026
EPSS score23.25%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (blog.trailofbits.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Redhat12 products
- lemon< 0:3.26.0-17.el8_7
- lemon-debuginfo< 0:3.26.0-17.el8_7 | < 0:3.34.1-6.el9_1
- sqlite< 0:3.26.0-17.el8_7 | < 0:3.34.1-6.el9_1
- sqlite-analyzer-debuginfo< 0:3.26.0-17.el8_7 | < 0:3.34.1-6.el9_1
- sqlite-debuginfo< 0:3.26.0-17.el8_7 | < 0:3.34.1-6.el9_1
Ubuntu2 products
- sqliteAll versions (No fix recorded)
- sqlite3< 3.11.0-1ubuntu1.5+esm2 | < 3.22.0-1ubuntu0.7 | < 3.31.1-4ubuntu0.5 | < 3.37.2-2ubuntu0.1 | < 3.8.2-1ubuntu2.2+esm3
Alpine1 product
- sqlite≥ 1.0.12 (No fix recorded)
Crates.Io1 product
- libsqlite3-sys< 0.25.1 | ≥ 0.0.0-0, < 0.25.1
Debian1 product
- sqlite3< 3.39.2-1
Mageia1 product
- sqlite3< 3.39.2-1.mga8
Netapp1 product
Opensuse1 product
- sqlite3&distro=openSUSE Tumbleweed< 3.39.2-1.1
Splunk1 product
- universal_forwarder≥ 8.2.0, < 8.2.12 | ≥ 9.0.0, < 9.0.6 | 9.1.0
Sqlite1 product
- sqlite≥ 1.0.12, < 3.39.2
10 vendors · 22 products
References
32 links- security.netapp.com/advisory/ntap-20220915-0009/Third Party Advisory
- blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/ARTICLEREPORTExploitThird Party Advisory
Show all 32 references
- github.com/rusqlite/rusqlitePACKAGE