CVE-2023-30608

Published: 18 April 2023

sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known workarounds for this issue.

Priority

Cvss 3 Severity Score

7.5

Score breakdown

Status

Package	Release	Status
sqlparse Launchpad, Ubuntu, Debian	bionic	Released (0.2.4-0.1ubuntu0.1)
	focal	Released (0.2.4-3ubuntu0.1)
	jammy	Released (0.4.2-1ubuntu0.22.04.1)
	kinetic	Released (0.4.2-1ubuntu0.22.10.1)
	lunar	Released (0.4.2-1ubuntu0.23.04.1)
	trusty	Ignored (out of standard support)
	upstream	Released (0.4.4)
	xenial	Not vulnerable (code not present)
	Patches: upstream: https://github.com/andialbrecht/sqlparse/commit/c457abd5f upstream: https://github.com/andialbrecht/sqlparse/commit/e75e35869473832a1eb67772b1adfee2db11b85a

Severity score breakdown

Parameter	Value
Base score	7.5
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Bugs

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034615

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›