CVE Feed

    Dashboard / CVE / CVE-2021-20227

    CVE-2021-20227

    A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.

    Published:Jan 21, 2021
    Last Modified:Nov 21, 2024
    EPS:Mar 23, 2021
    EPSS Score:0.00214
    CVSS Score:5.5

    Affected Products

    Vendor
    Oracle
    Product
    Communications Network Charging And Control
    Vendor
    Oracle
    Product
    Enterprise Manager For Oracle Database
    Vendor
    Oracle
    Product
    Jd Edwards Enterpriseone Tools
    Vendor
    Oracle
    Product
    Mysql Workbench
    Vendor
    Oracle
    Product
    Outside In Technology
    Vendor
    Oracle
    Product
    Zfs Storage Appliance Kit
    Vendor
    Sqlite
    Product
    Sqlite

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-416 Use After Free

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2021-45105 (CVSS 5.9) — Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolle…
    CVE-2021-2351 (CVSS 8.3) — Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that a…
    CVE-2020-36183 (CVSS 8.1) — FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and ty…
    CVE-2020-36181 (CVSS 8.1) — FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and ty…
    CVE-2020-36182 (CVSS 8.1) — FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and ty…
    CVE-2020-36179 (CVSS 8.1) — FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and ty…
    CVE-2020-36180 (CVSS 8.1) — FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and ty…
    CVE-2020-36187 (CVSS 8.1) — FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and ty…
    CVE-2020-36188 (CVSS 8.1) — FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and ty…
    CVE-2020-36184 (CVSS 8.1) — FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and ty…

    References

    https://bugzilla.redhat.com/show_bug.cgi?id=1924886
    https://security.gentoo.org/glsa/202103-04
    https://security.gentoo.org/glsa/202210-40
    https://security.netapp.com/advisory/ntap-20210423-0010/
    https://www.oracle.com//security-alerts/cpujul2021.html
    https://www.oracle.com/security-alerts/cpuApr2021.html
    https://www.oracle.com/security-alerts/cpuoct2021.html
    https://www.sqlite.org/releaselog/3_34_1.html
    https://bugzilla.redhat.com/show_bug.cgi?id=1924886
    https://security.gentoo.org/glsa/202103-04
    https://security.gentoo.org/glsa/202210-40
    https://security.netapp.com/advisory/ntap-20210423-0010/
    https://www.oracle.com//security-alerts/cpujul2021.html
    https://www.oracle.com/security-alerts/cpuApr2021.html
    https://www.oracle.com/security-alerts/cpuoct2021.html
    https://www.sqlite.org/releaselog/3_34_1.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High