Bug 2054793 (CVE-2021-45346) - CVE-2021-45346 sqlite: crafted SQL query allows a malicious user to obtain sensitive information
Summary: CVE-2021-45346 sqlite: crafted SQL query allows a malicious user to obtain se...
Keywords:
Status: NEW
Alias: CVE-2021-45346
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2054794 2054796 2080249 2054795 2080248 2080250
Blocks: 2054797
TreeView+ depends on / blocked
 
Reported: 2022-02-15 17:37 UTC by Guilherme de Almeida Suckevicz
Modified: 2022-05-11 14:03 UTC (History)
28 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A memory leak flaw was found in the SQLite Project via maliciously crafted SQL Queries (made via editing the Database File). This flaw allows a malicious user to obtain sensitive information due to a possible query to a record and leaking subsequent bytes of memory that extend beyond the record.
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2022-02-15 17:37:11 UTC
A Memory Leak vulnerabilty exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicous user obtain sensitive information..

Reference:
https://github.com/guyinatuxedo/sqlite3_record_leaking

Comment 1 Guilherme de Almeida Suckevicz 2022-02-15 17:37:45 UTC
Created mingw-sqlite tracking bugs for this issue:

Affects: fedora-all [bug 2054794]


Created sqlite tracking bugs for this issue:

Affects: fedora-all [bug 2054795]


Created sqlite2 tracking bugs for this issue:

Affects: fedora-all [bug 2054796]


Note You need to log in before you can comment on or make changes to this bug.