CVE-2021-45346

Publication date 14 February 2022

Last updated 24 July 2024


Ubuntu priority

Cvss 3 Severity Score

4.3 · Medium

Score breakdown

** DISPUTED ** A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.

Read the notes from the security team

Status

Package Ubuntu Release Status
sqlite 23.04 lunar Not in release
22.10 kinetic Ignored end of life, was ignored [vendor disputes CVE]
22.04 LTS jammy Ignored vendor disputes CVE
21.10 impish Ignored end of life
20.04 LTS focal Ignored vendor disputes CVE
18.04 LTS bionic Ignored vendor disputes CVE
16.04 LTS xenial Ignored vendor disputes CVE
14.04 LTS trusty Ignored vendor disputes CVE
sqlite3 23.04 lunar Ignored end of life, was ignored [vendor disputes CVE]
22.10 kinetic Ignored end of life, was ignored [vendor disputes CVE]
22.04 LTS jammy Ignored vendor disputes CVE
21.10 impish Ignored end of life
20.04 LTS focal Ignored vendor disputes CVE
18.04 LTS bionic Ignored vendor disputes CVE
16.04 LTS xenial Ignored vendor disputes CVE
14.04 LTS trusty Ignored vendor disputes CVE

Notes


eslerm

disputed by upstream "Yes, you can do that in SQLite. You can also do it in just about every other RDBMS and every filesystem ever invented."

Severity score breakdown

Parameter Value
Base score 4.3 · Medium
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality Low
Integrity impact None
Availability impact None
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N