CVE-2021-20227: Use After Free
A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.
Other sources
SQLite 3.34.1 fixes a potential use-after-free bug when processing a subquery with both a correlated WHERE clause and a "HAVING 0" clause and where the parent query is an aggregate.
References:
https://sqlite.org/src/info/30a4c323650cc949 https://www.sqlite.org/releaselog/3341.html
— Red Hat
SQLite is vulnerable to a denial of service, caused by a use-after-free flaw in the SELECT query function in src/select.c. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition or possibly execute arbitrary code on the system.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/sqliteto a version that resolves this vulnerability.Fixed in 3.34.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.34.1-1 - Upgrade
Upgrade
SQLiteto a version that resolves this vulnerability.Fixed in 3.34.1
Event History
Frequently Asked Questions
What is the vulnerability ID for this SQLite vulnerability?
The vulnerability ID for this SQLite vulnerability is CVE-2021-20227.
What is the severity rating of CVE-2021-20227?
CVE-2021-20227 has a severity rating of 5.5 (Medium).
How does CVE-2021-20227 affect SQLite?
CVE-2021-20227 in SQLite allows an attacker running SQL queries locally on the database to cause a denial of service or possible code execution.
Which versions of SQLite are affected by CVE-2021-20227?
SQLite versions up to exclusive 3.34.1 are affected by CVE-2021-20227.
Is there a fix available for CVE-2021-20227?
Yes, the remedy for CVE-2021-20227 is to update to SQLite version 3.34.1.