sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-highlineUpgrade rubygem-mime-types-dataUpgrade rubygem-domain_nameUpgrade rubygem-rest-clientUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hashieUpgrade rubygem-oauthUpgrade rubygem-clampUpgrade foreman-cliUpgrade rubygem-gssapiUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cliUpgrade rubygem-unfUpgrade rubygem-unicode-display_widthUpgrade satellite-cloneUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-foreman_maintainUpgrade satellite-cliUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-fast_gettextUpgrade rubygem-netrcUpgrade rubygem-unf_extUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-ffi-debuginfoUpgrade rubygem-little-pluggerUpgrade rubygem-ffiUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-loggingUpgrade python39-pulp_manifestUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-multi_jsonUpgrade rubygem-powerbarUpgrade rubygem-mime-typesUpgrade rubygem-snaky_hashUpgrade satellite-maintainUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-apipie-bindingsUpgrade rubygem-version_gemUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-ffi-debugsource | Nov 13, 2023 | Apr 18, 2023 |
| Debian | — | Upgrade sqlparse | May 18, 2023 | Apr 18, 2023 |
| Redhat_linux | — | Upgrade satellite-cloneUpgrade rubygem-apipie-bindingsUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-foreman_maintainUpgrade rubygem-powerbarUpgrade rubygem-unicode-display_widthUpgrade satellite-cliUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unf_extUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hashieUpgrade rubygem-version_gemUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_adminUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade python39-pulp_manifestUpgrade rubygem-http-cookieUpgrade rubygem-ffiUpgrade rubygem-netrcUpgrade rubygem-loggingUpgrade rubygem-little-pluggerUpgrade rubygem-unicode-debugsourceUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cliUpgrade rubygem-clampUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-gssapiUpgrade rubygem-jwtUpgrade rubygem-ffi-debugsourceUpgrade rubygem-localeUpgrade rubygem-oauthUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unicodeUpgrade rubygem-snaky_hashUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-ffi-debuginfoUpgrade rubygem-highlineUpgrade rubygem-http-acceptUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-rest-client | Nov 13, 2023 | Apr 18, 2023 |
| Rocky_linux | — | Upgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-debuginfoUpgrade libdb-cxxUpgrade libdb-debugsource | Mar 5, 2024 | Apr 18, 2023 |
| Suse | — | Upgrade python311-sqlparseUpgrade python3-sqlparse | Jun 9, 2023 | Apr 18, 2023 |
| Ubuntu | — | Upgrade python3-sqlparseUpgrade python-sqlparse | May 11, 2023 | Apr 18, 2023 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub