CVE-2021-20227

MediumCVSS 5.5/10Last modified Oct 14, 2026

Description

A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	sqlite	sqlite 3.34.1
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5

References

https://bugzilla.redhat.com/show_bug.cgi?id=1924886Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/202103-04Third Party Advisory
https://security.gentoo.org/glsa/202210-40Third Party Advisory
https://security.netapp.com/advisory/ntap-20210423-0010/Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
https://www.sqlite.org/releaselog/3_34_1.htmlRelease Notes, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1924886Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/202103-04Third Party Advisory
https://security.gentoo.org/glsa/202210-40Third Party Advisory
https://security.netapp.com/advisory/ntap-20210423-0010/Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
https://www.sqlite.org/releaselog/3_34_1.htmlRelease Notes, Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Timeline

Published: Mar 23, 2021
Last modified: Oct 14, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-202287.5A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when CVE-2021-202294.3A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query CVE-2021-20234.7Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: APIs). Supported versions that are affected are 12 CVE-2021-202307.5A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and ve CVE-2021-202319.8A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequence CVE-2021-202329.8A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other CVE-2021-202338.2A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length calculation on the assum CVE-2021-202346.5An uncontrolled resource consumption (memory leak) flaw was found in the ZeroMQ client in versions before 4.3.3 in src/pipe.cpp. This issue CVE-2021-202358.1There's a flaw in the zeromq server in versions before 4.3.3 in src/decoder_allocators.hpp. The decoder static allocator could have its size CVE-2021-202369.8A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the CVE-2021-202377.5An uncontrolled resource consumption (memory leak) flaw was found in ZeroMQ's src/xpub.cpp in versions before 4.3.3. This flaw allows a remo CVE-2021-202383.7It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from cl