CVE-2021-20227: Use After Free
A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.
Other sources
SQLite 3.34.1 fixes a potential use-after-free bug when processing a subquery with both a correlated WHERE clause and a "HAVING 0" clause and where the parent query is an aggregate.
References:
https://sqlite.org/src/info/30a4c323650cc949 https://www.sqlite.org/releaselog/3341.html
— Red Hat
SQLite is vulnerable to a denial of service, caused by a use-after-free flaw in the SELECT query function in src/select.c. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition or possibly execute arbitrary code on the system.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this SQLite vulnerability?
The vulnerability ID for this SQLite vulnerability is CVE-2021-20227.
What is the severity rating of CVE-2021-20227?
CVE-2021-20227 has a severity rating of 5.5 (Medium).
How does CVE-2021-20227 affect SQLite?
CVE-2021-20227 in SQLite allows an attacker running SQL queries locally on the database to cause a denial of service or possible code execution.
Which versions of SQLite are affected by CVE-2021-20227?
SQLite versions up to exclusive 3.34.1 are affected by CVE-2021-20227.
Is there a fix available for CVE-2021-20227?
Yes, the remedy for CVE-2021-20227 is to update to SQLite version 3.34.1.