Bug 2054793 (CVE-2021-45346) - CVE-2021-45346 sqlite: crafted SQL query allows a malicious user to obtain sensitive information
Summary: CVE-2021-45346 sqlite: crafted SQL query allows a malicious user to obtain se...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2021-45346
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2054794 2054795 2054796 2080248 2080249 2080250
Blocks: 2054797
TreeView+ depends on / blocked
 
Reported: 2022-02-15 17:37 UTC by Guilherme de Almeida Suckevicz
Modified: 2025-04-04 14:17 UTC (History)
28 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2022-09-22 13:01:33 UTC
Embargoed:

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2022-02-15 17:37:11 UTC 
A Memory Leak vulnerabilty exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicous user obtain sensitive information..

Reference:
https://github.com/guyinatuxedo/sqlite3_record_leaking
Comment 1 Guilherme de Almeida Suckevicz 2022-02-15 17:37:45 UTC 
Created mingw-sqlite tracking bugs for this issue:

Affects: fedora-all [bug 2054794]


Created sqlite tracking bugs for this issue:

Affects: fedora-all [bug 2054795]


Created sqlite2 tracking bugs for this issue:

Affects: fedora-all [bug 2054796]
Note You need to log in before you can comment on or make changes to this bug.