Vulnerability · Published Feb 14, 2022 · Assigned by mitre
CVE-2021-45346
Medium 4.3
In plain English
A medium-severity security flaw in the sqlite3 package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).
Official description
A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | sqlite3 | no fix listed | DEBIAN-CVE-2021-45346 |
| Debian:13 | sqlite3 | no fix listed | DEBIAN-CVE-2021-45346 |
| Debian:14 | sqlite3 | no fix listed | DEBIAN-CVE-2021-45346 |
| Ubuntu:22.04:LTS | sqlite | no fix listed | UBUNTU-CVE-2021-45346 |
| Ubuntu:22.04:LTS | sqlite3 | no fix listed | UBUNTU-CVE-2021-45346 |