sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade satellite-maintainUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-snaky_hashUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-powerbarUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-http-acceptUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-jwtUpgrade rubygem-ffiUpgrade rubygem-multi_jsonUpgrade rubygem-little-pluggerUpgrade rubygem-loggingUpgrade rubygem-unicode-debugsourceUpgrade rubygem-mime-typesUpgrade rubygem-version_gemUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_templatesUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unicodeUpgrade satellite-cliUpgrade rubygem-unf_extUpgrade rubygem-ffi-debuginfoUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade satellite-cloneUpgrade rubygem-rest-clientUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unfUpgrade rubygem-http-cookieUpgrade rubygem-clampUpgrade foreman-cliUpgrade rubygem-gssapiUpgrade rubygem-hashieUpgrade rubygem-domain_nameUpgrade rubygem-oauthUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cliUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-mime-types-dataUpgrade rubygem-oauth-ttyUpgrade rubygem-unicode-display_widthUpgrade rubygem-highline | Nov 13, 2023 | Apr 18, 2023 |
| Debian | — | Upgrade sqlparse | May 18, 2023 | Apr 18, 2023 |
| Redhat_linux | — | Upgrade rubygem-unicode-debugsourceUpgrade foreman-cliUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-fast_gettextUpgrade rubygem-oauthUpgrade rubygem-http-acceptUpgrade rubygem-ffi-debugsourceUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-amazing_printUpgrade rubygem-jwtUpgrade rubygem-oauth-ttyUpgrade rubygem-localeUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-highlineUpgrade rubygem-hammer_cliUpgrade rubygem-rest-clientUpgrade rubygem-clampUpgrade rubygem-gssapiUpgrade rubygem-unicodeUpgrade rubygem-little-pluggerUpgrade rubygem-loggingUpgrade rubygem-unfUpgrade rubygem-multi_jsonUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade satellite-cloneUpgrade rubygem-foreman_maintainUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-mime-typesUpgrade rubygem-domain_nameUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unf_ext-debuginfoUpgrade satellite-cliUpgrade rubygem-ffiUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-version_gemUpgrade rubygem-unicode-display_widthUpgrade rubygem-powerbarUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hashieUpgrade rubygem-mime-types-dataUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unf_ext | Nov 13, 2023 | Apr 18, 2023 |
| Rocky_linux | — | Upgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxxUpgrade libdb-debugsourceUpgrade libdb-debuginfo | Mar 5, 2024 | Apr 18, 2023 |
| Suse | — | Upgrade python311-sqlparseUpgrade python3-sqlparse | Jun 9, 2023 | Apr 18, 2023 |
| Ubuntu | — | Upgrade python-sqlparseUpgrade python3-sqlparse | May 11, 2023 | Apr 18, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub