PT-2022-12329 · Sqlite3+1 · Sqlite3+1

Guyinatuxedo · Published 2022-02-14 · Updated 2024-08-04 · CVE-2021-45346

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SQLite3 versions 3.35.1 through 3.37.0

Description A Memory Leak issue exists in SQLite Project via maliciously crafted SQL Queries, made by editing the Database File. It is possible to query a record and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. The developer disputes this as a vulnerability, stating that if a corrupted database file is given to SQLite and a query is submitted against the database, it might read parts of the database that were not intended or expected.

Recommendations For versions 3.35.1 through 3.37.0, at the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BIT-SQLITE-2021-45346

CVE-2021-45346

ECHO-029C-4B57-FE88

Affected Products

Debian

Sqlite3

References · 17

• 🔥 https://github.com/guyinatuxedo/sqlite3_record_leaking · Exploit
• https://cve.org/CVERecord?id=CVE-2021-45346 · Security Note
• https://osv.dev/vulnerability/BIT-sqlite-2021-45346 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-45346 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-45346 · Vendor Advisory
• https://sqlite.org/forum/forumpost/53de8864ba114bf6 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-45346 · Vendor Advisory
• https://sqlite.org/forum/forumpost/056d557c2f8c452ed5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45346 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-45346 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-45346 · Vendor Advisory
• https://sqlite.org/cves.html#status_of_recent_sqlite_cves · Vendor Advisory
• https://t.me/cvenotify/27662 · Telegram Post
• https://t.me/cibsecurity/37446 · Telegram Post
• https://t.me/cvenotify/38319 · Telegram Post