CVE-2021-45346: SQL Injection
First published: Mon Feb 14 2022(Updated: )
** DISPUTED ** A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SQLite SQLite | =3.35.1 | |
| SQLite SQLite | =3.37.0 | |
| NetApp ONTAP Select Deploy administration utility | ||
| =3.35.1 | ||
| =3.37.0 | ||
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this SQLite memory leak vulnerability?
The vulnerability ID for this SQLite memory leak vulnerability is CVE-2021-45346.
What is the severity rating of CVE-2021-45346?
The severity rating of CVE-2021-45346 is medium, with a score of 4.3.
How does the memory leak vulnerability in SQLite Project SQLite3 3.35.1 and 3.37.0 occur?
The memory leak vulnerability in SQLite Project SQLite3 3.35.1 and 3.37.0 occurs via maliciously crafted SQL Queries made via editing the Database File.
What is the potential impact of the SQLite memory leak vulnerability?
The SQLite memory leak vulnerability could allow a malicious user to query a record and leak subsequent bytes of memory that extend beyond the record.
Are there any known fixes or mitigations for CVE-2021-45346?
At this time, there are no known fixes or mitigations for CVE-2021-45346. It is recommended to follow the official SQLite website and the software vendor for any updates or patches.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/author
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/status
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- status/disputed
- vendor/sqlite
- canonical/sqlite sqlite
- version/sqlite sqlite/3.35.1
- version/sqlite sqlite/3.37.0
- vendor/netapp
- canonical/netapp ontap select deploy administration utility