Your submission was sent successfully! Close

You have successfully unsubscribed! Close

CVE-2021-45346

Published: 14 February 2022

** DISPUTED ** A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.

Notes

AuthorNote
eslerm
disputed by upstream
"Yes, you can do that in SQLite. You can also do it in just
about every other RDBMS and every filesystem ever invented."

Priority

Low

Cvss 3 Severity Score

4.3

Score breakdown

Status

Package Release Status
sqlite
Launchpad, Ubuntu, Debian
bionic Ignored
(vendor disputes CVE)
focal Ignored
(vendor disputes CVE)
impish Ignored
(vendor disputes CVE)
jammy Ignored
(vendor disputes CVE)
trusty Ignored
(vendor disputes CVE)
upstream Ignored
(vendor disputes CVE)
xenial Needs triage

sqlite3
Launchpad, Ubuntu, Debian
bionic Ignored
(vendor disputes CVE)
focal Ignored
(vendor disputes CVE)
impish Ignored
(vendor disputes CVE)
jammy Ignored
(vendor disputes CVE)
trusty Ignored
(vendor disputes CVE)
upstream Ignored
(vendor disputes CVE)
xenial Ignored
(vendor disputes CVE)

Severity score breakdown

Parameter Value
Base score 4.3
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality Low
Integrity impact None
Availability impact None
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N