sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-version_gemUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-netrcUpgrade rubygem-little-pluggerUpgrade rubygem-unicode-debuginfoUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-http-acceptUpgrade python39-pulp_manifestUpgrade rubygem-apipie-bindingsUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-loggingUpgrade rubygem-snaky_hashUpgrade satellite-maintainUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-ffiUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unicode-debugsourceUpgrade satellite-cliUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-powerbarUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-multi_jsonUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-http-cookieUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-clampUpgrade rubygem-rest-clientUpgrade rubygem-amazing_printUpgrade rubygem-gssapiUpgrade foreman-cliUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unfUpgrade rubygem-oauthUpgrade rubygem-hashieUpgrade satellite-cloneUpgrade rubygem-unicode-display_widthUpgrade rubygem-highlineUpgrade rubygem-foreman_maintainUpgrade rubygem-oauth-ttyUpgrade rubygem-mime-types-data | Nov 13, 2023 | Apr 18, 2023 |
| Debian | — | Upgrade sqlparse | May 18, 2023 | Apr 18, 2023 |
| Redhat_linux | — | Upgrade rubygem-domain_nameUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-mime-typesUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unfUpgrade rubygem-unf_extUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-foreman_maintainUpgrade rubygem-multi_jsonUpgrade satellite-cloneUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-apipie-bindingsUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-ffiUpgrade satellite-maintainUpgrade rubygem-version_gemUpgrade rubygem-hashieUpgrade rubygem-unicode-display_widthUpgrade rubygem-http-cookieUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-oauth-ttyUpgrade rubygem-fast_gettextUpgrade rubygem-localeUpgrade rubygem-ffi-debugsourceUpgrade rubygem-ffi-debuginfoUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicode-debuginfoUpgrade rubygem-loggingUpgrade rubygem-snaky_hashUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-clampUpgrade rubygem-hammer_cliUpgrade rubygem-unicode-debugsourceUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-rest-clientUpgrade rubygem-unicodeUpgrade rubygem-highlineUpgrade rubygem-http-acceptUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade foreman-cliUpgrade rubygem-little-plugger | Nov 13, 2023 | Apr 18, 2023 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfo | Mar 5, 2024 | Apr 18, 2023 |
| Suse | — | Upgrade python3-sqlparseUpgrade python311-sqlparse | Jun 9, 2023 | Apr 18, 2023 |
| Ubuntu | — | Upgrade python3-sqlparseUpgrade python-sqlparse | May 11, 2023 | Apr 18, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub