CVE-2021-45346
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.
** EN DISPUTA ** Se presenta una vulnerabilidad de pérdida de memoria en SQLite Project SQLite3 versiones 3.35.1 y 3.37.0 por medio de consultas SQL diseñadas de forma maliciosa (realizadas por medio de la edición del archivo de la base de datos), es posible consultar un registro, y filtrar los bytes de memoria subsiguientes que son extendidos más allá del registro, lo que podría permitir a un usuario malicioso obtener información confidencial. NOTA: El desarrollador disputa esto como una vulnerabilidad afirmando que si le das a SQLite un archivo de base de datos corrupto y envías una consulta contra la base de datos, podría leer partes de la base de datos que no pretendías o esperabas
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-12-20 CVE Reserved
- 2022-02-14 CVE Published
- 2023-09-07 EPSS Updated
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-401: Missing Release of Memory after Effective Lifetime
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://security.netapp.com/advisory/ntap-20220303-0001 | Third Party Advisory |
|
| URL | Date | SRC |
|---|---|---|
| https://github.com/guyinatuxedo/sqlite3_record_leaking | 2024-08-04 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://sqlite.org/forum/forumpost/056d557c2f8c452ed5 | 2024-05-17 | |
| https://sqlite.org/forum/forumpost/53de8864ba114bf6 | 2024-05-17 | |
| https://www.sqlite.org/cves.html#status_of_recent_sqlite_cves | 2024-05-17 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Sqlite Search vendor "Sqlite" | Sqlite Search vendor "Sqlite" for product "Sqlite" | 3.35.1 Search vendor "Sqlite" for product "Sqlite" and version "3.35.1" | - |
Affected
| ||||||
| Sqlite Search vendor "Sqlite" | Sqlite Search vendor "Sqlite" for product "Sqlite" | 3.37.0 Search vendor "Sqlite" for product "Sqlite" and version "3.37.0" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Ontap Select Deploy Administration Utility Search vendor "Netapp" for product "Ontap Select Deploy Administration Utility" | - | - |
Affected
| ||||||