Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2021-45346

Published: 14 February 2022

** DISPUTED ** A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.

Notes

AuthorNote
eslerm
disputed by upstream
"Yes, you can do that in SQLite. You can also do it in just
about every other RDBMS and every filesystem ever invented."

Priority

Low

Cvss 3 Severity Score

4.3

Score breakdown

Status

Package Release Status
sqlite
Launchpad, Ubuntu, Debian
jammy Ignored
(vendor disputes CVE)
bionic Ignored
(vendor disputes CVE)
focal Ignored
(vendor disputes CVE)
impish Ignored
(end of life)
trusty Ignored
(vendor disputes CVE)
upstream Ignored
(vendor disputes CVE)
kinetic Ignored
(end of life, was ignored [vendor disputes CVE])
lunar Does not exist

xenial Ignored
(vendor disputes CVE)
sqlite3
Launchpad, Ubuntu, Debian
jammy Ignored
(vendor disputes CVE)
bionic Ignored
(vendor disputes CVE)
focal Ignored
(vendor disputes CVE)
impish Ignored
(end of life)
trusty Ignored
(vendor disputes CVE)
upstream Ignored
(vendor disputes CVE)
xenial Ignored
(vendor disputes CVE)
kinetic Ignored
(end of life, was ignored [vendor disputes CVE])
lunar Ignored
(end of life, was ignored [vendor disputes CVE])

Severity score breakdown

Parameter Value
Base score 4.3
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality Low
Integrity impact None
Availability impact None
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N