CVE-2021-45346 Information disclosure in n/a

Medium 4.3 Published 14 Feb 2022 Updated 4 Aug 2024

A maliciously crafted database file can cause SQLite to leak memory bytes beyond the intended record, allowing attackers to read sensitive information.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-45346?

CVE-2021-45346 is a medium-severity vulnerability in Netapp Ontap Select Deploy Administration Utility, published on 14 Feb 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.

Weakness: CWE-401

Which versions are affected by CVE-2021-45346?

1 open source package ship an affected version, including sqlite. It affects 2 products.

Package	Affected	Fixed in
`sqlite` Bitnami	From `3.35.1`	`3.35.2, 3.37.1`

Products include Netapp Ontap Select Deploy Administration Utility, Sqlite Sqlite.

How do I fix CVE-2021-45346?

Upgrade sqlite to a fixed version for your release line: 3.35.2 or 3.37.1.

Is CVE-2021-45346 being exploited?

There is no known exploitation of CVE-2021-45346 in the wild and no public exploit code.

All Netapp Ontap Select Deploy Administration Utility vulnerabilities

Sources

Also known as BIT-sqlite-2021-45346, DEBIAN-CVE-2021-45346, GHSA-w3q4-xr8h-32gf.