PYSEC-2023-87

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/sqlparse/PYSEC-2023-87.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2023-87
Aliases
Published
2023-04-18T22:15:00Z
Modified
2023-11-08T04:12:25.842993Z
Summary
[none]
Details

sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit e75e358. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit c457abd5f. Users are advised to upgrade. There are no known workarounds for this issue.

References

Affected packages

PyPI / sqlparse

Package

Affected ranges

Type
GIT
Repo
https://github.com/andialbrecht/sqlparse
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
Fixed
Type
ECOSYSTEM
Events
Introduced
0.1.15
Fixed
0.4.4

Affected versions

0.*

0.1.15
0.1.16
0.1.17
0.1.18
0.1.19
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.4.0
0.4.1
0.4.2
0.4.3