Input validation error in SQLite - CVE-2021-20223

Vulnerability identifier: #VU67413

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-20223

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of user-supplied input within the fts5UnicodeTokenize() function in ext/fts5/fts5_tokenize.c, which caused the unicode61 tokenizer configured to treat unicode "control-characters" (class Cc), was treating embedded nul characters as tokens. A remote attacker can pass specially crafted input to the application and bypass implemented security restrictions.

SQLite
Ubuntu
openEuler
libsqlite3-0 (Ubuntu package)
sqlite3 (Ubuntu package)
sqlite
sqlite-devel
sqlite-debuginfo
sqlite-debugsource
sqlite-help

Install updates from vendor's website.

SQLite - update to 3.34.0
libsqlite3-0 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
sqlite3 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 3.22.0-1ubuntu0.6, 3.31.1-4ubuntu0.4
sqlite - update to 3.32.3-5
sqlite-devel - update to 3.32.3-5
sqlite-debuginfo - update to 3.32.3-5
sqlite-debugsource - update to 3.32.3-5
sqlite-help - update to 3.32.3-5

• https://github.com/sqlite/sqlite/commit/d1d43efa4fb0f2098c0e2c5bf2e807c58d5ec05b
• https://www.sqlite.org/forum/forumpost/09609d7e22
• https://sqlite.org/src/info/b7b7bde9b7a03665

• Security restrictions bypass in Sqlite
• Ubuntu update for sqlite3
• openEuler 20.03 LTS SP1 update for sqlite
• openEuler 20.03 LTS SP3 update for sqlite
• Ubuntu update for sqlite3