PFSense 2.8.1 vulnerable to CVE-2025-6965?
-
Hola,
I am running PFsense and home and can see my PFsense firewall is running sqlite3-3.46.1, which is vulnerable to CVE-2025-6965 according to Nessus. Is that of concern, what do you recommend I do to fix it or why does it not affect PFsense?
Sorry for the noob question.
-
Run these commands to list what additional packages are using sqlite3.
pkg info | grep -i sqlite php83-pdo_sqlite-8.3.19 The pdo_sqlite shared extension for php php83-sqlite3-8.3.19 The sqlite3 shared extension for php sqlite3-3.46.1,1 SQL database engine in a C library pkg info -r sqlite3 sqlite3-3.46.1,1: php83-sqlite3-8.3.19 php83-pdo_sqlite-8.3.19The only thing I saw on the roadmap was "Upgrade PHP to 8.4", but not sure if that addresses CVE-2025-6965
https://redmine.pfsense.org/projects/pfsense/roadmap
https://redmine.pfsense.org/issues/16471Looks like we may have to wait for an official patch/update from Netgate.
-
@UniqueUser From a cursory look it sounds like it's a problem with a malicious query. Generally one would need to be on the pfSense router to connect to it? So unless pfSense has bad queries it seems like not an issue. Not that I'm an sqlite expert.
-
The version of sqlite in 25.11 is 3.50.2.
That said, I would not view it as an exploitable issue for pfSense as it requires the ability to execute arbitrary queries in sqlite3. That generally requires modifying the code on the system.
