logo

Database

Asymmetric denial of service - ReDoS In sqlparse

Description

sqlparse contains a regular expression that is vulnerable to Regular Expression Denial of Service

Impact

The SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). The vulnerability may lead to Denial of Service (DoS).

Patches

This issues has been fixed in sqlparse 0.4.4.

Workarounds

None.

References

This issue was discovered and reported by GHSL team member @erik-krogh (Erik Krogh Kristensen).

    Commit that introduced the vulnerability: e75e35869473832a1eb67772b1adfee2db11b85a

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2023-306082. NVD-2023-306083. OSV-2023-306084. OSV-DEBIAN-2023-306085. GHSA-rrm6-wvj7-cwh26. GCVE-2023-306087. lists.debian.org8. lists.debian.org9. SECURITY-TRACKER-CVE-2023-30608

References

1. https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh22. https://github.com/andialbrecht/sqlparse/commit/c457abd5f097dd13fb21543381e7cfafe7d31cfb3. https://github.com/andialbrecht/sqlparse/commit/e75e35869473832a1eb67772b1adfee2db11b85a4. https://github.com/pypa/advisory-database/tree/main/vulns/sqlparse/PYSEC-2023-87.yaml5. https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.