What’s Vulnerable › Vulnerabilities

CVE-2021-20227

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-03-23 · updated 2026-10-14
• Weakness: CWE-416

Description

A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.

Affected products

• Oracle Communications Network Charging And Control: from 12.0.1.0 through 12.0.4.0.0; 6.0.1
• Oracle Enterprise Manager For Oracle Database: 13.4.0.0
• Oracle Corporation JD Edwards EnterpriseOne Tools: before 9.2.6.0 — fixed in 9.2.6.0
• Oracle Corporation MySQL Workbench: through 8.0.26
• Oracle Corporation Outside In Technology: 8.5.5
• Oracle Corporation Oracle ZFS Storage Appliance Kit: 8.8
• SQLite: from 3.33.0 before 3.34.1 — fixed in 3.34.1

How to fix

Upgrade to a fixed version: Oracle Corporation JD Edwards EnterpriseOne Tools 9.2.6.0; SQLite 3.34.1. Check the vendor advisory for mitigations.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=1924886
• https://security.gentoo.org/glsa/202103-04
• https://security.gentoo.org/glsa/202210-40
• https://security.netapp.com/advisory/ntap-20210423-0010/
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://www.sqlite.org/releaselog/3_34_1.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1924886
• https://security.gentoo.org/glsa/202103-04
• https://security.gentoo.org/glsa/202210-40
• https://security.netapp.com/advisory/ntap-20210423-0010/

Get alerted when CVE-2021-20227 or the next vulnerability affects your stack