sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-amazing_printUpgrade rubygem-highlineUpgrade rubygem-mime-types-dataUpgrade rubygem-foreman_maintainUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unicode-display_widthUpgrade satellite-cloneUpgrade foreman-cliUpgrade rubygem-gssapiUpgrade rubygem-oauthUpgrade rubygem-oauth-ttyUpgrade rubygem-unfUpgrade rubygem-http-cookieUpgrade rubygem-clampUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-domain_nameUpgrade rubygem-rest-clientUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-little-pluggerUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-multi_jsonUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unf_extUpgrade rubygem-netrcUpgrade rubygem-unicode-debugsourceUpgrade rubygem-ffi-debugsourceUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-version_gemUpgrade rubygem-mime-typesUpgrade rubygem-loggingUpgrade rubygem-apipie-bindingsUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade python39-pulp_manifestUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_adminUpgrade satellite-maintainUpgrade rubygem-snaky_hashUpgrade rubygem-unicodeUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_discovery | Nov 13, 2023 | Apr 18, 2023 |
| Debian | — | Upgrade sqlparse | May 18, 2023 | Apr 18, 2023 |
| Redhat_linux | — | Upgrade foreman-cliUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-clampUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-http-acceptUpgrade rubygem-highlineUpgrade rubygem-oauth-ttyUpgrade rubygem-little-pluggerUpgrade rubygem-rest-clientUpgrade rubygem-unicodeUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-unicode-debuginfoUpgrade rubygem-ffi-debuginfoUpgrade rubygem-amazing_printUpgrade rubygem-unicode-debugsourceUpgrade rubygem-oauthUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-localeUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-fast_gettextUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-domain_nameUpgrade satellite-maintainUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-mime-typesUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unfUpgrade rubygem-version_gemUpgrade rubygem-powerbarUpgrade rubygem-http-cookieUpgrade rubygem-unicode-display_widthUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-apipie-bindingsUpgrade python39-pulp_manifestUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unf_extUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-foreman_maintainUpgrade rubygem-netrcUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-mime-types-dataUpgrade rubygem-multi_json | Nov 13, 2023 | Apr 18, 2023 |
| Rocky_linux | — | Upgrade libdb-sql-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-debugsourceUpgrade libdb-cxxUpgrade libdb-debuginfo | Mar 5, 2024 | Apr 18, 2023 |
| Suse | — | Upgrade python311-sqlparseUpgrade python3-sqlparse | Jun 9, 2023 | Apr 18, 2023 |
| Ubuntu | — | Upgrade python-sqlparseUpgrade python3-sqlparse | May 11, 2023 | Apr 18, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub