Threats affecting pkg:cargo/sqlcipher-src

SQLite versions before 3.54.0 have a vulnerability where opening a database file alongside a write-ahead-log (-wal) file with a differing page size can cause uninitialized page-cache memory to be returned. This can lead to queries returning stale memory bytes. The sqlcipher-src crate versions from 419.0.3 up to but not including 420.0.0, which bundle SQLCipher 4.19.0 on SQLite 3.53.4, are affected. The issue is fixed in sqlcipher-src 420.0.0. Exploitation requires local access and the victim process to open crafted files potentially controlled by a less trusted party.