CVE-2021-20227: Oracle Communications Network Charging And Control

Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days.

A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.

Affected products

• Oracle Communications Network Charging And Control: from 12.0.1.0, up to and including 12.0.4.0.0; version 6.0.1 only
• Oracle Enterprise Manager For Oracle Database: version 13.4.0.0 only
• Oracle Jd Edwards Enterpriseone Tools: before 9.2.6.0 (fixed in 9.2.6.0)
• Oracle MySQL Workbench: up to and including 8.0.26
• Oracle Outside In Technology: version 8.5.5 only
• Oracle ZFS Storage Appliance Kit: version 8.8 only
• Sqlite Sqlite: from 3.33.0, before 3.34.1 (fixed in 3.34.1)

Published 2021-03-23. Last modified 2026-06-17.