GitHub Advisoryadvisory · PyPI
GHSA-rrm6-wvj7-cwh2 sqlparse contains a regular expression that is vulnerable to Regular Expression Denial of Service
MEDIUM
Official page ↗
- Aliases
- CVE-2023-30608
- Ecosystem
- PyPI
- Packages
- sqlparse
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-1333
- Reviewed
- 2023-04-21
Affected packages
• PyPI sqlparse: >= 0.1.15, < 0.4.4 → fixed in 0.4.4
Description
Impact
The SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). The vulnerability may lead to Denial of Service (DoS).
Patches
This issues has been fixed in sqlparse 0.4.4.
Workarounds
None.
References
This issue was discovered and reported by GHSL team member @erik-krogh (Erik Krogh Kristensen).
• Commit that introduced the vulnerability: e75e35869473832a1eb67772b1adfee2db11b85a
Related
Alias · CVE (1)
- CVE-2023-30608 sqlparse is a non-validating SQL parser module for Python. vulnerability
Weakness · CWE (1)
- CWE-1333 Inefficient Regular Expression Complexity weakness
References
- https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2 web
- https://nvd.nist.gov/vuln/detail/CVE-2023-30608 advisory
- https://github.com/andialbrecht/sqlparse/commit/c457abd5f097dd13fb21543381e7cfafe7d31cfb web
- https://github.com/andialbrecht/sqlparse/commit/e75e35869473832a1eb67772b1adfee2db11b85a web
- https://github.com/andialbrecht/sqlparse package
- https://github.com/pypa/advisory-database/tree/main/vulns/sqlparse/PYSEC-2023-87.yaml web
- https://lists.debian.org/debian-lts-announce/2023/05/msg00017.html web
- https://lists.debian.org/debian-lts-announce/2024/12/msg00022.html web
- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS web