sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-hashieUpgrade rubygem-highlineUpgrade rubygem-domain_nameUpgrade rubygem-unicode-display_widthUpgrade rubygem-mime-types-dataUpgrade rubygem-clampUpgrade rubygem-oauthUpgrade satellite-cloneUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-foreman_maintainUpgrade rubygem-rest-clientUpgrade rubygem-unfUpgrade rubygem-gssapiUpgrade rubygem-unf_ext-debugsourceUpgrade foreman-cliUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-fast_gettextUpgrade rubygem-netrcUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-ffi-debugsourceUpgrade rubygem-loggingUpgrade rubygem-localeUpgrade rubygem-apipie-bindingsUpgrade rubygem-version_gemUpgrade rubygem-mime-typesUpgrade satellite-maintainUpgrade rubygem-snaky_hashUpgrade rubygem-little-pluggerUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-powerbarUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unf_extUpgrade python39-pulp_manifestUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade satellite-cliUpgrade rubygem-ffi-debuginfoUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-http-acceptUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_openscap | Nov 13, 2023 | Apr 18, 2023 |
| Debian | — | Upgrade sqlparse | May 18, 2023 | Apr 18, 2023 |
| Redhat_linux | — | Upgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-http-acceptUpgrade rubygem-amazing_printUpgrade rubygem-ffi-debugsourceUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-localeUpgrade rubygem-hammer_cliUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-highlineUpgrade rubygem-unicode-debuginfoUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-rest-clientUpgrade rubygem-fast_gettextUpgrade rubygem-gssapiUpgrade foreman-cliUpgrade rubygem-oauth-ttyUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-loggingUpgrade rubygem-oauthUpgrade rubygem-snaky_hashUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-jwtUpgrade rubygem-hashieUpgrade rubygem-multi_jsonUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade python39-pulp_manifestUpgrade satellite-maintainUpgrade rubygem-version_gemUpgrade rubygem-mime-types-dataUpgrade rubygem-unicode-display_widthUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-apipie-bindingsUpgrade rubygem-netrcUpgrade satellite-cliUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-mime-typesUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-http-cookieUpgrade rubygem-domain_name | Nov 13, 2023 | Apr 18, 2023 |
| Rocky_linux | — | Upgrade libdb-debuginfoUpgrade libdb-debugsourceUpgrade libdb-cxxUpgrade libdb-sql-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-utils-debuginfo | Mar 5, 2024 | Apr 18, 2023 |
| Suse | — | Upgrade python311-sqlparseUpgrade python3-sqlparse | Jun 9, 2023 | Apr 18, 2023 |
| Ubuntu | — | Upgrade python3-sqlparseUpgrade python-sqlparse | May 11, 2023 | Apr 18, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub