Medium severity · published Feb 14, 2022
CVE-2021-45346
A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a…
4.3
CVSS
1.6%
EPSS
No
On KEV
Description
A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
Ontap Select Deploy Administration Utility · Netapp
All versions, or not specified · source: NVD
SQ
Sqlite · Sqlite
3.35.1; 3.37.0 · source: NVD
Affected product
OS
Ontap Select Deploy Administration Utility
Netapp
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-45346
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-45346
Exploit
https://github.com/guyinatuxedo/sqlite3_record_leaking
Third Party Advisory
https://security.netapp.com/advisory/ntap-20220303-0001/
Vendor Advisory
https://sqlite.org/forum/forumpost/056d557c2f8c452ed5
Vendor Advisory
https://sqlite.org/forum/forumpost/53de8864ba114bf6
Vendor Advisory
https://www.sqlite.org/cves.html#status_of_recent_sqlite_cves
More from Ontap Select Deploy Administration Utility
9.6
CVE-2020-15999
Google Chrome FreeType Heap Buffer Overflow Vulnerability
7.8
CVE-2023-4911
Glibc: buffer overflow in ld.so leading to privilege escalation
7.8
CVE-2021-3156
Sudo Heap-Based Buffer Overflow Vulnerability
7.0
CVE-2016-5195
Linux Kernel Race Condition Vulnerability
9.8
CVE-2024-21990
ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x contain hard-coded credentials that could allow an attacker to view Deploy configuration…