Published: 20/09/2021 Updated: 29/09/2021

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in sqlparse vulnerability. The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments. Only the formatting feature that removes comments from SQL statements is affected by this regular expression. As a workaround don't use the sqlformat.format function with keyword strip_comments=True or the --strip-comments command line flag when using the sqlformat command line tool. The issues has been fixed in sqlparse 0.4.2.

Vulnerable Product	Search on Vulmon	Subscribe to Product
sqlparse project sqlparse

Synopsis Moderate: Satellite 611 Release Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update is now available for Red Hat Satellite 611 Description Red Hat Satellite is a systems management tool for Linux-basedin ...

Debian Bug report logs - #994841 sqlparse: CVE-2021-32839 Package: src:sqlparse; Maintainer for src:sqlparse is Andrii Senkovych <andrii@senkovychcom>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 21 Sep 2021 19:06:02 UTC Severity: grave Tags: security, upstream Found in version sqlparse/041-1 ...

A resource-consumption flaw was found in python-sqlparse The formatter function that strips comments from SQL contains a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS) A network attacker could craft an SQL comment containing numerous repetitions of '\r\n' that could cause exponential backtracking and cause t ...

In python-sqlparse versions 040 and 041 there is a regular Expression Denial of Service in sqlparse vulnerability The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments Only the formatting feature that removes comments from SQL statements is affected by this regular expressi ...

https://cybersecuritybase.mooc.fi

Vulnerable blog application Cyber Security Base 2022 Project 1 Description A blogging application with login functionality Once logged in, users can create and publish blog posts, as well as post comments on existing posts Non-logged-in users can browse the available blog posts Installation NOTE: On MacOS you might need to refer to a specific python version, eg python3

CWE-400 https://github.com/andialbrecht/sqlparse/commit/8238a9e450ed1524e40cb3a8b0b3c00606903aeb https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-p5w8-wqhj-9hhf https://access.redhat.com/errata/RHSA-2022:5498 https://nvd.nist.gov https://github.com/HeikkiLu/cybersecuritymooc-project1 https://access.redhat.com/security/cve/cve-2021-32839

CVE-2021-32839

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect