Skip to content

Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service)

Moderate
andialbrecht published GHSA-rrm6-wvj7-cwh2 Apr 18, 2023

Package

python-sqlparse (Python)

Affected versions

>=0.1.15

Patched versions

0.4.4

Description

Impact

The SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). The vulnerability may lead to Denial of Service (DoS).

Patches

This issues has been fixed in sqlparse 0.4.4.

Workarounds

None.

References

This issue was discovered and reported by GHSL team member @erik-krogh (Erik Krogh Kristensen).

  • Commit that introduced the vulnerability: e75e358

Severity

Moderate
5.5
/ 10

CVSS base metrics

Attack vector
Local
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE ID

CVE-2023-30608

Weaknesses

Credits