CVE-2023-30608 — Regex Denial of Service in Project Sqlparse

CWE-1333 — Regex Denial of Service7 documents6 sources
Severity
7.5HIGHNVD
EPSS
1.1%
top 22.04%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Sqlparse Project SqlparseDebian SqlparseAndialbrecht Sqlparse+1 more
Timeline
PublishedApr 18
Latest updateMay 10

Description

sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶debiandebian/sqlparse< sqlparse 0.4.2-1+deb12u1 (bookworm)
▶NVDsqlparse_project/sqlparse0.1.15 — 0.4.4
▶PyPIsqlparse_project/sqlparse0.1.15 — 0.4.4
▶Debiansqlparse_project/sqlparse< 0.4.1-1+deb11u1+3
▶CVEListV5andialbrecht/sqlparse>= 0.1.15, < 0.4.4

Also affects: Debian Linux 10.0

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
sqlparse contains a regular expression that is vulnerable to Regular Expression Denial of Service↗2023-04-21
▶
OSV
sqlparse contains a regular expression that is vulnerable to Regular Expression Denial of Service↗2023-04-21
▶
OSV
CVE-2023-30608: sqlparse is a non-validating SQL parser module for Python↗2023-04-18
▶

📋Vendor Advisories

3
Ubuntu
SQL parse vulnerability↗2023-05-10
▶
Red Hat
sqlparse: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service)↗2023-04-19
▶
Debian
CVE-2023-30608: sqlparse - sqlparse is a non-validating SQL parser module for Python. In affected versions ...↗2023
▶