andialbrecht/sqlparse · Security
sqlparse contains a regular expression that is vulnerable to Regular Expression Denial of Service
- GHSA ID
- GHSA-rrm6-wvj7-cwh2
- CVE ID
- CVE-2023-30608
- Severity
- medium
- Published
- Updated
- CVSS
- 5.5 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- CVSS v3
- 5.5 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- CVSS v4
- 6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Description
Impact
The SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). The vulnerability may lead to Denial of Service (DoS).
Patches
This issues has been fixed in sqlparse 0.4.4.
Workarounds
None.
References
This issue was discovered and reported by GHSL team member @erik-krogh (Erik Krogh Kristensen).
- Commit that introduced the vulnerability: e75e35869473832a1eb67772b1adfee2db11b85a
CWEs
- CWE-1333 · Inefficient Regular Expression Complexity
References
- https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2023-30608 ↗
- https://github.com/andialbrecht/sqlparse/commit/c457abd5f097dd13fb21543381e7cfafe7d31cfb ↗
- https://github.com/andialbrecht/sqlparse/commit/e75e35869473832a1eb67772b1adfee2db11b85a ↗
- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS ↗
- https://lists.debian.org/debian-lts-announce/2023/05/msg00017.html ↗
- https://github.com/pypa/advisory-database/tree/main/vulns/sqlparse/PYSEC-2023-87.yaml ↗
- https://lists.debian.org/debian-lts-announce/2024/12/msg00022.html ↗
- https://github.com/advisories/GHSA-rrm6-wvj7-cwh2 ↗